# Chat Demo Path Traversal Vulnerability (CVE-2026-118976)

## Description

November 2026 - [CVE-2026-118976](https://www.cve.org/CVERecord?id=CVE-2026-118976)

* In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.

### What Are the Impacts

In Telerik® UI for Blazor, versions prior to v14.1.0, the demo application's Chat - AI Integration sample implementation surfaced a path traversal vulnerability. An attacker can read server-side files outside the chat upload folder that the demo process can access. That can expose local configuration, bundled demo data, and other readable deployment files. The issue **does not provide write access or code execution**, but it breaks filesystem isolation.

## Issue

* CWE-23: Relative Path Traversal
* CAPEC-139: Relative Path Traversal

## Solution

To resolve this demo-only vulnerability, obtain the corrected demo source from the Telerik UI for Blazor 14.1.0 or later [ZIP archive](https://www.telerik.com/blazor-ui/documentation/installation/zip), and update and redeploy the demo application. If you copied the affected implementation into your application, apply the corresponding source changes there as well. Updating only the `Telerik.UI.for.Blazor` NuGet package does not update copied demo code.

| Current Version            | Update to   |
| -------------------------- | ----------- |
| `>= 11.1.0` && `<= 14.0.0` | `>= 14.1.0` |

Follow the [update instructions](https://www.telerik.com/blazor-ui/documentation/upgrade/overview) for precise instructions. All customers who have a license for Telerik UI for Blazor  can access their downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Notes

* This issue only affects the demo application code, not the Chat component itself.
* If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.

## External References

[CVE-2026-118976](https://www.cve.org/CVERecord?id=CVE-2026-118976) (7.5)

**CVSS:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Progress® Telerik® UI for Blazor versions older than v14.1.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder.