In Progress® Telerik® Reporting versions prior to 2025 Q1 (19.0.25.211), information disclosure is possible by a local threat actor through an absolute path vulnerability.
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as “/abs/path” that can resolve to a location that is outside of that directory.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Telerik_reporting | Progress | * | 19.0.25.211 (excluding) |