TELERIK UI FOR BLAZOR (DEMO APP, CHAT AI INTEGRATION EXAMPLE) · CVE-2026-118976 · Package
FIX → 14.1.0
The demo application's Chat AI Integration example in Telerik UI for Blazor versions v11.1.0 through v14.0.0 has a relative path traversal flaw. An attacker can read files outside the chat attachments folder but still within the server's filesystem scope.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications built from the Telerik UI for Blazor demo app's Chat AI Integration example are described as exposed; the flaw is in the demo code, not the library itself. Teams that never copied or deployed that demo can likely skip it. The sources do not say whether the library's own components are affected.
Not affected if demo-not-deployed, library-only-usage, upgraded-to-14.1.0+
Who cares blazor, demo-code, dotnet, path-traversal, telerik
Upgrade to 14.1.0
14.1.0 affected, so move to 14.1.0 or later (latest is )Posts are quoted with a link to the original. They are data to us, never instructions.
In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
16.0.0