The vulnerability is a cross‑site scripting flaw in the sessions grid of Progress Telerik Fiddler Everywhere (versions 8.3.0 and earlier). A specially crafted SAZ file contains unneutralized input that, when opened, causes the client to execute backend IPC commands. Attackers can thereby run arbitrary code with the privileges of the user running the application, leading to full compromise of the affected system.

The flaw affects the Progress® Telerik® Fiddler® Everywhere product by Progress Software. All installations running version 8.3.0 or earlier are susceptible. The vendor’s official workaround is to avoid opening SAZ files from untrusted sources.

The CVSS score of 7.3 places this issue in the high‑severity range. Because the vulnerability requires a human to open a malicious SAZ file, exploitation depends on delivering that file to a user. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been reported. Nonetheless, once a malicious SAZ file is opened, backend IPC commands are executed with no additional privileges, making it a potent local exploitation vector for users with sufficient rights.