Telerik UI for ASP.NET AJAX < 2026.3.812 Multiple Vulnerabilities

The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is prior to 2026.3.812. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may...

CVE-2026-18672

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

EUVD-2026-69897

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

CVE-2026-18672 RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

CVE-2026-18672 RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

CVE-2026-18672

CVE-2026-18672 affects Progress Telerik UI for AJAX prior to v2026.3.812 . The vulnerability resides in the RadImageEditor control, where insufficient validation of client-supplied state allows an unauthenticated, network-based attacker to manipulate which file the control's image cache returns, ...

CVE-2026-18672: Improper Limitation of a Pathname to a Restricted Directory

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

PT-2026-84661

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...