What’s Vulnerable › Vulnerabilities
CVE-2026-118038: Path Traversal in Telerik Document Processing Libraries AI Agent Tools
- Severity: high (CVSS 7.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-28 · updated 2026-10-28
- Weakness: CWE-22
Description
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files where they are writable, via relative file paths that resolve against the process current working directory.
Affected products
- Progress Software Telerik Document Processing Libraries: from 2026.1.210 before 2026.3.1027 — fixed in 2026.3.1027
How to fix
Upgrade to a fixed version: Progress Software Telerik Document Processing Libraries 2026.3.1027. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-118038 or the next vulnerability affects your stack