The vulnerability allows an authenticated attacker with low privileges who can supply arguments to the Convert and Merge AI agent tools to read files outside the configured output directory and overwrite writable files via relative paths. This permits unauthorized disclosure of confidential data and modification of system files, compromising integrity and potentially availability. The weakness is a classic path traversal flaw (CWE-22).

Products from Progress Software, specifically Telerik Document Processing Libraries, are affected in all releases prior to version 2026.3.1027. The issue exists in the Convert and Merge AI agent tools component.

The CVSS score of 7.1 indicates a high severity. No EPSS score is publicly available, so current exploitation likelihood is uncertain. The vulnerability is not currently listed in CISA’s KEV catalog. The exploit requires authentication with low‑privileged credentials, but allows file read/write when the attacker can supply arguments, making it potentially useful in targeted attacks. The tool uses relative paths resolved against the process current working directory, making it executable from any location the application can access.