Live › vulnerability › CVE-2026-118038
Go to dashboardThe Convert and Merge AI agent tools in Telerik Document Processing Libraries resolve relative file paths against the process working directory, so path traversal is possible. An authenticated low-privilege user who can supply tool arguments can read files outside the configured output directory and overwrite writable ones.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Applications that use Telerik Document Processing Libraries before and expose the Convert and Merge AI agent tools to users or to an agent that accepts tool arguments from them are exposed. Teams that do not use those AI agent tools, or that run only versions at or above , can skip it.
2026.3.10272026.3.1027No product ranges from the sources yet.
2026.3.1027.2026.3.1027 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files where they are writable, via relative file paths that resolve against the process current working directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-118038")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.