EUVD-2026-47694
GHSA-hh76-q7vh-vv92
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated handler with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is information disclosure/SSRF only, so C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
AnalysisAI
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application embeds Telerik UI for ASP.NET AJAX (pre-v2026.2.708) and exposes the spell check handler (RadSpell/spell check dialog) reachable over the network; the attacker manipulates the language / DictionaryLanguage parameter to influence server-side file path resolution and trigger outbound server-side requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates a remote, low-complexity, no-authentication, no-interaction path with high confidentiality impact but no integrity or availability effect - consistent with an information-disclosure/file-read and SSRF primitive rather than code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker sends a crafted request to the Telerik spell check handler with a manipulated DictionaryLanguage/language value pointing at an absolute or traversal path (or an internal URL), causing the server to resolve that path or issue a server-side request and return or leak the referenced content. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed. … |
| Remediation | Vendor-released patch: v2026.2.708 - upgrade the Telerik UI for ASP.NET AJAX assemblies in all affected applications to v2026.2.708 or later as the primary fix, per the advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-spellchecker-dictionarylanguage-path-traversal-CVE-2026-13189. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and services using Progress Telerik UI for ASP.NET AJAX and identify systems running versions prior to 2026.2.708; prioritize internet-facing or high-value systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistenc
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers
Same weakness CWE-36 – Absolute Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today