EUVD-2026-47699
GHSA-wwqj-8cp4-vjmh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Network-exposed handler with hardcoded key allows unauthenticated read and deletion; I:L assigned to capture file deletion impact omitted from the NVD-provided I:N.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.
AnalysisAI
Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The ChartImage.axd HTTP handler must be registered in the application's web.config and reachable over HTTP/HTTPS - this registration is included by default in Telerik UI for ASP.NET AJAX installations that use or have historically used RadChart, and may persist as a dead registration even after RadChart is no longer actively used. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) captures the network-accessible, zero-prerequisite exploitation but contains a notable discrepancy: I:N does not account for the file deletion capability described in the CVE - deletion of application files is an integrity impact and should be verified against the vendor advisory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote unauthenticated attacker scans a target ASP.NET application for exposed .axd handler endpoints and identifies ChartImage.axd. Using the hardcoded cryptographic key - either extracted from the Telerik assembly or obtained from public research - the attacker forges a valid signed request to read image-extension files from the application directory, potentially enumerating stored assets or application structure. … |
| Remediation | The primary fix is to upgrade to Telerik UI for ASP.NET AJAX v2026.2.708 or later, as confirmed by the Progress Software vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radchart-hardcoded-key-file-read-cve-2026-14932. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telerik Ui For Asp Net Ajax
View allAn issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. Rated critical severity (CVSS 9.8), this vul
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX be
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with exte
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistenc
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resoluti
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metada
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allo
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attacker
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today