CVE-2026-118038 In Progress Telerik Document Processing Libraries - Path Traversal

In Progress Telerik Document Processing Libraries < 2026.3.1027 contain a path traversal caused by relative file paths in Convert and Merge AI agent tools, letting authenticated low-privilege attackers read or overwrite files outside output directory.

CVSS base score 7.1 /10
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Required
View the NVD record ↗

Details

Type
Path Traversal
Impact
File System Read, File System Write, Information Disclosure, Data Tampering
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Published
28 October 2026
Updated
29 October 2026
Weakness
CWE-22

Vendor fix

Update to version 2026.3.1027 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs