Progress Software security advisory (AV26-875)
Canada's Cyber Centre warns Progress Telerik UI for ASP.NET AJAX before 2026.3.812 is affected by path traversal and upload tampering flaws, urging updates.
The Canadian Centre for Cyber Security issued advisory AV26-875 on September 2, 2026, covering vulnerabilities in Progress Software Telerik UI for ASP.NET AJAX prior to version 2026.3.812. Two flaws are listed: CVE-2026-18672, a path traversal in the Telerik Web Forms RadImageEditor, and CVE-2026-19219, a DialogHandler UploadPaths tampering vulnerability. Administrators are encouraged to review the provided links and apply available updates.
- CVE-2026-18672: path traversal in Telerik Web Forms RadImageEditor
- CVE-2026-19219: DialogHandler UploadPaths tampering vulnerability
- Fixed in Telerik UI for ASP.NET AJAX version 2026.3.812
- Vendors
- Progress SoftwareTelerik
- Products
- Telerik UI for ASP.NET AJAX
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-19219+1 related CVE | Potential RCE in Progress Telerik UI for ASP.NET AJAX via dialog parameter tampering | 8.1 group max | <1% |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-875 Date: September 2, 2026 As of September 2, 2026, Progress Software is affected by vulnerabilities in the following product: Telerik UI for ASP. NET AJAX Prior to 2026. 3.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.