CVE-2026-118976

{
  "etk_id": "ETK-2026-4395",
  "cve_id": "CVE-2026-118976",
  "display_id": "CVE-2026-118976",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-125354",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in Telerik UI for Blazor Chat AI demo",
  "summary": "Telerik UI for Blazor versions 11.1.0 through 14.0.0 include a relative path traversal issue in the demo application's Chat AI Integration example. An attacker may be able to read files outside the chat attachments folder that are within the server's filesystem scope. Exposure requires the affected demo example to be deployed or otherwise reachable.",
  "mitigation": "Upgrade Telerik UI for Blazor to version 14.1.0 or later. Remove or restrict access to the affected Chat AI Integration demo until the upgrade is complete.",
  "vendor": "Progress Software",
  "product": "Telerik UI for Blazor",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 11.1.0, < 14.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "14.1.0"
      ],
      "package_name": "Telerik UI for Blazor",
      "purl": null
    }
  ],
  "cwes": [
    23
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.392832033333335,
  "t0_at": "2026-11-13T14:33:21.126000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T14:33:21.126000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T14:33:21.126000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-118976"
    }
  }
}