CVE-2026-118976

CVSS 7.5 (high) · published 2026-11-13

In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.

Weakness: CWE-23

Source: NVD CVE-2026-118976

References

• https://www.telerik.com/blazor-ui/documentation/knowledge-base/kb-security-demo-path-traversal-cve-2026-118976

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.