Path Traversal and Deserialization in Telerik UI for AJAX (CVE-2026-13186)

A path traversal vulnerability in the file-based persistence storage provider of Progress Telerik UI for AJAX allows an attacker to influence which file is loaded as persistence state when the storage key is derived from user-controlled input. This enables attacker-controlled deserialization and remote code execution. The risk is elevated if another feature in the application allows writing files to the server's App_Data directory. Affected versions: - 2013.1.220 - 2026.2.519 We recommend updating to: 2026.2.708. CVSS 8.1 · our assessment: this_week Reference: https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-appdata-path-traversal-deserialization-CVE-2026-13186 Details: https://vuln.today/cve/CVE-2026-13186