What is the CVSS score of CVE-2026-13189?

CVE-2026-13189 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Telerik UI are affected by CVE-2026-13189?

Progress Telerik UI for ASP.NET AJAX versions before 2026.2.708 contain a path traversal vulnerability enabling remote attackers to access sensitive server-side files without authentication.. A patch is available.

How to fix or mitigate CVE-2026-13189?

Within 24 hours, inventory all applications and services using Progress Telerik UI for ASP.NET AJAX and identify systems running versions prior to 2026.2.708; prioritize internet-facing or high-value systems. Within 7 days, implement network-level access controls restricting traffic to the spell check handler endpoints and deploy input validation to block malicious DictionaryLanguage parameter values; request patch availability and timeline from Progress Software support. Within 30 days, establish persistent monitoring and alerting for spell check handler requests, complete security assessment of affected systems to identify potentially accessed files, and prepare upgrade plans for version 2026.2.708 or later when vendor releases patches.

Telerik UI CVE-2026-13189

EUVD-2026-47694 HIGH

Absolute Path Traversal (CWE-36)

2026-07-22 ProgressSoftware

GHSA-hh76-q7vh-vv92

Information Disclosure Telerik Ui For Asp Net Ajax Progress Software

7.5

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated handler with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is information disclosure/SSRF only, so C:H with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:33 vuln.today

CVE Published

Jul 22, 2026 - 13:42 cve.org

HIGH 7.5

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.

AnalysisAI

Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Telerik UI for ASP.NET AJAX is a widely used commercial suite of server-side web controls (RadEditor, RadSpell, RadAsyncUpload, etc.) embedded in .NET web applications, historically a high-value target for path and deserialization flaws. The affected component is the spell check handler (RadSpell/spell check dialog), which accepts a DictionaryLanguage/language parameter used to locate the dictionary file on the server. CWE-36 (Absolute Path Traversal) is the root cause class: user-controlled input flows into a file path without adequate normalization or allow-listing, so the parameter can reference paths outside the intended dictionary directory and, per the advisory, can also steer the handler into making server-side requests (an SSRF-like secondary effect). The single affected CPE is cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax.

RemediationAI

Vendor-released patch: v2026.2.708 - upgrade the Telerik UI for ASP.NET AJAX assemblies in all affected applications to v2026.2.708 or later as the primary fix, per the advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-spellchecker-dictionarylanguage-path-traversal-CVE-2026-13189. Where immediate patching is not possible, disable or remove the spell check (RadSpell) handler if the application does not use spell checking, or restrict access to the spell check endpoint via web server/WAF rules that reject requests supplying traversal-style or absolute-path values in the DictionaryLanguage/language parameter - noting these controls break legitimate multi-language spell checking and can be bypassed if filtering is incomplete. Additionally, apply egress network filtering from the web server to limit the impact of forced server-side requests, with the trade-off that overly strict outbound rules may disrupt legitimate integrations.