{"id":"CVE-2026-104656","kind":"vulnerability","aliases":["CVE-2026-104656"],"related":[],"title":"Fiddler Everywhere: crafted SAZ file runs backend commands when opened","description":"Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.","summary":"Progress Telerik Fiddler Everywhere 8.3.0 and earlier fails to neutralize input in its sessions grid. A user who opens a specially crafted SAZ file can have an attacker execute backend IPC commands.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fiddler-everywhere","package","telerik","windows"],"not_affected_if":["fiddler-classic","no-untrusted-saz-files"],"how_to_check":"- Check the installed Fiddler Everywhere version in the app's About dialog or package metadata; compare against `8.3.0`","fix":"- Fiddler Everywhere: move to a version later than `8.3.0` (the fixed version is not named in the sources)","status":"open","published_at":"2026-11-06T17:17:11+00:00","first_seen_at":"2026-11-06T17:43:11+00:00","triaged_at":"2026-11-06T17:45:08+00:00","updated_at":"2026-11-06T17:45:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T17:45:08Z","model":"claude-haiku-5-5","output":{"fix":"- Fiddler Everywhere: move to a version later than `8.3.0` (the fixed version is not named in the sources)","reach":"local","title":"Fiddler Everywhere: crafted SAZ file runs backend commands when opened","impact":"high","summary":"Progress Telerik Fiddler Everywhere 8.3.0 and earlier fails to neutralize input in its sessions grid. A user who opens a specially crafted SAZ file can have an attacker execute backend IPC commands.","audience":"developers","category":"package","nicknames":[],"who_cares":["fiddler-everywhere","telerik","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs backend IPC commands on the user's machine","analyst_note":"Confirm the fixed version and whether the flaw is limited to opening SAZ files; check the Progress security advisory for Telerik Fiddler Everywhere.","how_to_check":"- Check the installed Fiddler Everywhere version in the app's About dialog or package metadata; compare against `8.3.0`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["fiddler-classic","no-untrusted-saz-files"],"who_is_affected":"Developers and testers who run Fiddler Everywhere 8.3.0 or earlier and open SAZ session archives, especially ones received from others. The sources do not say whether exposure depends on any non-default setting.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4214,"output_tokens":546,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104656':13A,16A '-2026':12A,15A '8.3.0':27B,68C 'allow':71C 'attack':50B,73C 'backend':7A,52B,76C 'command':8A,54B,78C 'convinc':80C 'craft':3A,44B,87C 'cve':11A,14A 'earlier':29B,70C 'everywher':2A,19B,26B,67C 'execut':51B,75C 'fail':30B 'fiddler':1A,18B,25B,66C 'fiddler-everywher':17B 'file':5A,46B,89C 'grid':37B,62C 'improp':55C 'input':33B,58C 'ipc':53B,77C 'neutral':32B,56C 'open':10A,41B,84C 'packag':20B 'progress':23B,64C 'run':6A 'saz':4A,45B,88C 'session':36B,61C 'special':43B,86C 'telerik':21B,24B,65C 'user':39B,82C 'window':22B","nicknames":[],"mitigations":[],"who_affected":"Developers and testers who run Fiddler Everywhere 8.3.0 or earlier and open SAZ session archives, especially ones received from others. The sources do not say whether exposure depends on any non-default setting.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fiddlereverywhere","high","package","telerik","windows"],"campaign_type":null,"search_a":"'-104656':13A,16A '-2026':12A,15A 'backend':7A 'command':8A 'craft':3A 'cve':11A,14A 'everywher':2A 'fiddler':1A 'file':5A 'open':10A 'run':6A 'saz':4A","search_b":"'8.3.0':27B 'attack':50B 'backend':52B 'command':54B 'craft':44B 'earlier':29B 'everywher':19B,26B 'execut':51B 'fail':30B 'fiddler':18B,25B 'fiddler-everywher':17B 'file':46B 'grid':37B 'input':33B 'ipc':53B 'neutral':32B 'open':41B 'packag':20B 'progress':23B 'saz':45B 'session':36B 'special':43B 'telerik':21B,24B 'user':39B 'window':22B","search_c":"'8.3.0':68C 'allow':71C 'attack':73C 'backend':76C 'command':78C 'convinc':80C 'craft':87C 'earlier':70C 'everywher':67C 'execut':75C 'fiddler':66C 'file':89C 'grid':62C 'improp':55C 'input':58C 'ipc':77C 'neutral':56C 'open':84C 'progress':64C 'saz':88C 'session':61C 'special':86C 'telerik':65C 'user':82C","first_public_at":"2026-11-06T17:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104656","severity":null,"published_at":"2026-11-06T17:17:11+00:00","modified_at":"2026-11-06T17:17:11+00:00","first_seen_at":"2026-11-06T17:43:11+00:00","fetched_at":"2026-11-06T17:43:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}