CVE-2026-118038
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal…
- Risk score
- 43/100
- CVSS
- 7.1 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files …
- Affected
- See advisory
- Fix
- Upgrade the product to 2026.3.1027 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
Original description
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files where they are writable, via relative file paths that resolve against the process current working directory.
Last activity 28 Oct 2026. Patch Forecast updates every hour.