CVE-2026-118976: Path Traversal in Telerik UI for Blazor Demo's Chat AI Integration Example
In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Progress Telerik UI for Blazor versions v11.1.0 through v14.0.0 are affected when the demo application's Chat AI Integration example is present. The issue is in that demo example rather than being described as affecting all application components.
What could an unauthenticated attacker do?
The supplied vector indicates network-based exploitation with low attack complexity, no privileges, and no user interaction required. An attacker could use relative path traversal to read files outside the chat attachments folder, limited to files within the server filesystem scope.
Is data modification or service disruption described?
No. The provided impact information identifies high confidentiality impact and no integrity or availability impact, so the described risk is unauthorized file disclosure.