Progress Telerik Convert/Merge AI agent tools path traversal (read/overwrite outside output dir)

The Convert and Merge AI agent tools resolve relative file paths against the process current working directory instead of locking them to the configured output directory, enabling path traversal for arbitrary file read and, where writable, overwrite (CVSS 7.1, CWE-22).

AI agent tools that manipulate files on behalf of a low-privilege user become a channel to read and overwrite files outside the intended sandbox, risking disclosure of documents/configuration and tampering with files the agent later consumes.

An authenticated low-privilege caller supplies tool arguments with relative paths that resolve against the process working directory, allowing reads outside the configured output directory and overwrites of writable files.

Progress Telerik Document Processing Libraries >= 2026.1.210, < 2026.3.1027

Upgrade to Telerik Document Processing Libraries 2026.3.1027 (see KB advisory); constrain tool-argument paths to the intended output directory.