EUVD-2026-47691
GHSA-jxcm-j98v-7cfr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but AC:H because exploitation depends on file-based persistence with a user-derived key and winning the deserialization chain, yielding full RCE impact (C/I/A:H).
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution.
AnalysisAI
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application uses Telerik UI for AJAX's file-based persistence storage provider AND that the persistence storage key is derived from user-controlled input - this is the exact prerequisite stated in the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are moderately but not uniformly alarming. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a Telerik-powered .NET application where a control's persistence storage key reflects a request parameter, then submits a request with traversal sequences in that parameter to make the file-based provider load a serialized object from an attacker-influenced path. When the provider deserializes that object, a gadget chain executes arbitrary code in the web application's process context. … |
| Remediation | Vendor-released patch: upgrade Progress Telerik UI for ASP.NET AJAX to v2026.2.708 or later, which is the primary and recommended fix; consult the vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-appdata-path-traversal-deserialization-CVE-2026-13186 for exact upgrade steps. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of systems running Progress Telerik UI for ASP.NET AJAX using dependency scanning tools and manual code review; prioritize production systems and internet-facing applications handling sensitive data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today