{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118976","assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","state":"PUBLISHED","assignerShortName":"ProgressSoftware","dateReserved":"2026-10-29T09:13:28.520Z","datePublished":"2026-11-13T14:33:21.126Z","dateUpdated":"2026-11-13T14:33:21.126Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware","dateUpdated":"2026-11-13T14:33:21.126Z"},"title":"Path Traversal in Telerik UI for Blazor Demo's Chat AI Integration Example","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-23","description":"CWE-23 Relative path traversal","type":"CWE"}]}],"impacts":[{"descriptions":[{"lang":"en","value":"Path Traversal"}]}],"affected":[{"vendor":"Progress Software","product":"Telerik UI for Blazor","versions":[{"status":"affected","version":"11.1.0","lessThan":"14.1.0","versionType":"custom"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.","supportingMedia":[{"type":"text/html","base64":false,"value":"In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope."}]}],"references":[{"url":"https://www.telerik.com/blazor-ui/documentation/knowledge-base/kb-security-demo-path-traversal-cve-2026-118976","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}}}}