EUVD-2026-47691
GHSA-jxcm-j98v-7cfr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but AC:H because exploitation depends on file-based persistence with a user-derived key and winning the deserialization chain, yielding full RCE impact (C/I/A:H).
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution.
AnalysisAI
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
Telerik UI for ASP.NET AJAX is a widely used commercial suite of RadControls (RadEditor, RadAsyncUpload, RadGrid, etc.) embedded in .NET web applications; the affected component is its file-based persistence storage provider, which serializes control state/configuration to disk under an application data path. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the persistence storage key is built from user-controlled input without canonicalization, so traversal sequences let an attacker point reads/writes outside the intended AppData directory. This traversal becomes an RCE primitive because the provider deserializes the file it loads - a classic .NET insecure-deserialization sink where an attacker-planted or attacker-selected serialized object triggers code execution during hydration. The CPE cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax identifies the affected product line; Telerik has a long history of deserialization issues in these controls, giving this class of flaw strong precedent.
RemediationAI
Vendor-released patch: upgrade Progress Telerik UI for ASP.NET AJAX to v2026.2.708 or later, which is the primary and recommended fix; consult the vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-appdata-path-traversal-deserialization-CVE-2026-13186 for exact upgrade steps. Where immediate upgrade is not possible, reduce exposure by ensuring the persistence storage key is not derived from user-controlled request input (use server-generated or fixed keys), or switch the persistence provider away from the file-based provider to a database/managed provider so the traversal-to-file sink is removed - note this may require configuration and testing of state persistence behavior. As additional compensating controls, restrict filesystem permissions on the AppData/persistence directory so the web process cannot read attacker-planted files outside its intended path, and place WAF rules to block path traversal sequences (../, encoded variants) on parameters feeding persistence, accepting that WAF filtering is best-effort and can be bypassed. These mitigations are stopgaps; applying the patch is the only complete fix.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who ha
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today