CVE-2026-118038 in Telerik Document Processing Libraries
Summary
by MITRE • 10/28/2026
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files where they are writable, via relative file paths that resolve against the process current working directory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within the Progress Telerik Document Processing Libraries, specifically affecting versions prior to 2026.3.1027. This vulnerability is categorized as a path traversal issue located in the Convert and Merge AI agent tools. The core technical deficiency involves an insufficient validation of user-supplied input when constructing file paths for document processing operations. When an authenticated attacker with low privileges provides tool arguments, they can manipulate relative file paths that are resolved against the process current working directory rather than being strictly confined to a designated output sandbox or whitelist. This lack of canonicalization allows the application to traverse up the directory tree using standard path traversal sequences such as dot-dot-slash characters, thereby bypassing intended access controls and reaching files outside the configured output directory.
From an operational perspective, this vulnerability presents significant risks regarding both data confidentiality and system integrity. An attacker who successfully exploits this flaw can read sensitive configuration files, source code, or other documents stored in directories above the application root, leading to unauthorized information disclosure. Furthermore, if the target file is writable by the process user, the attacker can overwrite existing files with malicious content. This capability enables potential remote code execution scenarios if critical executable scripts or configuration files are overwritten, or it allows for defacement and service disruption through data corruption. The severity of this impact is amplified because the vulnerability requires only low-privilege authentication to exploit, making it accessible to a broader range of threat actors who may have gained initial foothold access within the application environment.
This technical flaw aligns with Common Weakness Enumeration identifier CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. The exploitation technique mirrors patterns observed in MITRE ATT&CK framework techniques related to Command and Scripting Interpreter abuse or File Discovery, where an adversary leverages application functionality to access restricted resources for reconnaissance or further compromise. To mitigate this vulnerability, organizations must immediately upgrade the Progress Telerik Document Processing Libraries to version 2026.3.1027 or later, which includes patches addressing these input validation deficiencies. Additionally, developers should implement strict allow-listing of permitted file paths and ensure that all relative path inputs are canonicalized and verified against a secure base directory before processing. Applying the principle of least privilege to the application runtime environment further reduces the impact by limiting write permissions to only necessary directories, thereby preventing unauthorized overwrites even if traversal is attempted.