CVE-2026-19219

Progress Telerik UI for ASP.NET AJAX before v2026.3.812 provides insufficient integrity protection (CWE-345) on the dialog request parameters used by the RadEditor file browser, allowing those parameters to be altered. To exploit it, a network attacker must first have obtained certain application encryption key material used to protect the dialog parameters, which drives the high attack complexity; no privileges or user interaction are required. With tampered parameters, the attacker can control which folders the file browser reads from, writes to, and uploads into, enabling arbitrary file uploads (CWE-434) and potentially remote code execution by writing attacker-controlled files into sensitive or web-executable locations. Any web application built with Telerik UI for ASP.NET AJAX in versions prior to 2026.3.812 is affected. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade Telerik UI for ASP.NET AJAX to v2026.3.812 or later. Audit how the Telerik dialog/encryption key material is configured for each application — rotate keys that may have been exposed, avoid reusing key material across applications, and treat leaked or shared keys as the main precondition for exploitation. For applications exposing RadEditor file browser dialogs, verify where uploads are written and whether uploaded files can execute (e.g., ASPX files in web-accessible directories), and restrict dialog access where possible.