Progress Software security advisory (AV26-875)

Progress Telerik UI for ASP.NET AJAX versions before 2026.3.812 contain a path traversal flaw (CWE-22) in the RadImageEditor control, caused by insufficient validation of client-supplied state. A remote, unauthenticated attacker (per CVSS: AV:N/AC:L/PR:N/UI:N) can submit manipulated state so that the control's image cache returns an attacker-influenced file. Successful abuse can expose the contents of files located outside the intended image directories, producing high confidentiality impact with no integrity or availability impact per the CVSS scoring. Any web application built on Telerik UI for ASP.NET AJAX that exposes RadImageEditor on a version older than 2026.3.812 is affected. There is no known exploitation, no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation within 30 days.

Do: Upgrade Telerik UI for ASP.NET AJAX to version 2026.3.812 or later and verify the deployed Telerik.Web.UI assembly is no longer below that build. If an immediate upgrade is not possible, restrict access to pages hosting RadImageEditor (e.g., via authentication or network controls) and review image-cache requests that cause files to be returned from outside the configured image directories. Monitor the Progress advisory (AV26-875) for updates or added indicators.

Progress Telerik UI for ASP.NET AJAX before v2026.3.812 provides insufficient integrity protection (CWE-345) on the dialog request parameters used by the RadEditor file browser, allowing those parameters to be altered. To exploit it, a network attacker must first have obtained certain application encryption key material used to protect the dialog parameters, which drives the high attack complexity; no privileges or user interaction are required. With tampered parameters, the attacker can control which folders the file browser reads from, writes to, and uploads into, enabling arbitrary file uploads (CWE-434) and potentially remote code execution by writing attacker-controlled files into sensitive or web-executable locations. Any web application built with Telerik UI for ASP.NET AJAX in versions prior to 2026.3.812 is affected. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

Do: Upgrade Telerik UI for ASP.NET AJAX to v2026.3.812 or later. Audit how the Telerik dialog/encryption key material is configured for each application — rotate keys that may have been exposed, avoid reusing key material across applications, and treat leaked or shared keys as the main precondition for exploitation. For applications exposing RadEditor file browser dialogs, verify where uploads are written and whether uploaded files can execute (e.g., ASPX files in web-accessible directories), and restrict dialog access where possible.