CVE-2026-118038High· 7.1▾ TwilightIn Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files where they are writable, via relative file paths that resolve against the process current working directory.
telerik_document_processing_libraries >= 2026.1.210 < 2026.3.1027Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84294High· 7.7Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
CVE-2026-118039High· 7.5XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing
CVE-2026-118036High· 7.5Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering
CVE-2026-118040High· 7.5Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing
CVE-2026-118037High· 7.5Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing
CVE-2026-118035High· 7.5Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing