CVE-2026-118038: Path Traversal in Telerik Document Processing Libraries AI Agent Tools
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files where they are writable, via relative file paths that resolve against the process current working directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik Document Processing Librariesto a version that resolves this vulnerability.Fixed in 2026.3.1027
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments of Progress Telerik Document Processing Libraries before version 2026.3.1027 are exposed if the Convert or Merge AI agent tools are available to authenticated low-privileged users who can supply tool arguments.
What does an attacker need to exploit it?
An attacker needs valid authentication at a low privilege level and the ability to provide arguments to the Convert or Merge AI agent tools. Exploitation does not require user interaction and can be performed over the network.
What can an attacker do?
An attacker can use relative file paths that resolve from the process current working directory to read files outside the configured output directory. They may also overwrite files outside that directory when the process has permission to write them.
How can the issue be remediated?
Upgrade Progress Telerik Document Processing Libraries to version 2026.3.1027 or later. Until upgrading, restrict low-privileged users' access to the Convert and Merge AI agent tools and prevent untrusted users from supplying their arguments.