EUVD-2026-69897
GHSA-4j6f-v242-c6x4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-exploitable read via path traversal; no integrity or availability impact, high confidentiality loss from arbitrary file read.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.
AnalysisAI
Path traversal in the RadImageEditor component of Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.3.812) allows unauthenticated remote attackers to read arbitrary files from the server by supplying crafted state values that manipulate the control's image cache lookup. The vulnerability stems from insufficient server-side validation of client-controlled input that determines which file the cache mechanism retrieves, enabling directory traversal beyond the intended image directories. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must be running a version of Progress Telerik UI for ASP.NET AJAX prior to v2026.3.812, and must expose a page or endpoint that renders the RadImageEditor control. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately captures the core risk: unauthenticated, low-complexity, network-exploitable file read with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Progress Telerik UI for ASP.NET AJAX v2026.3.812 or later, which introduces sufficient server-side validation of the cache state parameter in RadImageEditor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ASP.NET applications using Telerik UI RadImageEditor and assess exposure (prioritize internet-facing instances); disable RadImageEditor functionality if not business-critical or restrict access to trusted internal networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistenc
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who ha
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today