Unauthenticated Path Traversal File Read in Telerik UI for ASP.NET AJAX RadImageEditor
AI analysis
Progress Telerik UI for ASP.NET AJAX versions before 2026.3.812 contain a path traversal flaw (CWE-22) in the RadImageEditor control, caused by insufficient validation of client-supplied state. A remote, unauthenticated attacker (per CVSS: AV:N/AC:L/PR:N/UI:N) can submit manipulated state so that the control's image cache returns an attacker-influenced file. Successful abuse can expose the contents of files located outside the intended image directories, producing high confidentiality impact with no integrity or availability impact per the CVSS scoring. Any web application built on Telerik UI for ASP.NET AJAX that exposes RadImageEditor on a version older than 2026.3.812 is affected. There is no known exploitation, no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation within 30 days.
What to do: Upgrade Telerik UI for ASP.NET AJAX to version 2026.3.812 or later and verify the deployed Telerik.Web.UI assembly is no longer below that build. If an immediate upgrade is not possible, restrict access to pages hosting RadImageEditor (e.g., via authentication or network controls) and review image-cache requests that cause files to be returned from outside the configured image directories. Monitor the Progress advisory (AV26-875) for updates or added indicators.
Affected
| Progress Telerik UI for ASP.NET AJAX (RadImageEditor component) | prior to 2026.3.812 |
Estimated exposure
large≈100,000+ deployments of the suite (only applications actually exposing RadImageEditor are vulnerable) — No published install counts exist; the estimate reflects the suite's long-standing, widespread embedding in enterprise ASP.NET WebForms applications, with public internet scans historically surfacing on the order of 10^5 Telerik ASP.NET…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.