Description

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T11:17:18.970Z",
  "pubdate": "2026-09-02T11:17:18.970Z",
  "executiveSummary": "This vulnerability involves insufficient validation of client-supplied state data within the RadImageEditor component of Progress Telerik UI for AJAX. The flaw enables an attacker to manipulate parameters to perform unauthorized file system access, effectively bypassing intended directory restrictions.\nThe vulnerability is classified as an improper input validation issue, specifically facilitating directory traversal. By influencing the internal image caching mechanism, an unauthenticated or authenticated attacker can force the application to retrieve arbitrary files from the underlying server's filesystem that are located outside the designated image storage directories.\nThe risk implication is significant, as it leads to sensitive information disclosure. Attackers can leverage this capability to read configuration files, source code, or other system-sensitive data that should remain inaccessible. The vulnerability impacts Telerik UI for AJAX versions prior to 2026.3.812. Exploitation does not necessarily require complex environmental conditions, making it a viable target for remote actors seeking to enumerate or exfiltrate data from the server environment.",
  "technicalDetails": "The vulnerability resides within the RadImageEditor component of the Telerik UI for AJAX suite. The core issue is the insecure handling of client-supplied state information used by the control to locate cached image files. When the RadImageEditor manages image states, it relies on client-provided data to reconstruct the path or reference to the image cache.\nThe root cause is a failure to implement rigorous validation and sanitization of this client-supplied state metadata. Because the component does not adequately verify that the requested file path resides within the authorized and intended image directory, it becomes susceptible to path traversal techniques. By injecting directory traversal sequences (e.g., ../) or manipulating specific state identifiers, an attacker can coerce the application into resolving paths for files outside the application's intended scope.\nThe attack flow proceeds as follows: First, the attacker intercepts the request sent by the RadImageEditor to the server-side handler responsible for retrieving cached images. Second, the attacker modifies the state parameter or the associated file reference to include path traversal payloads. Third, the Telerik control, failing to normalize or validate the input path against an allowlist, passes the malicious path to the file system API. Fourth, the server processes the request and returns the contents of the target file back to the attacker in the HTTP response. This allows for the iterative exfiltration of arbitrary files from the server, depending on the permissions of the service account under which the web application is running.\nThis vulnerability is particularly dangerous because it bypasses the logical boundaries set by the application's file management system. The attack can be performed remotely over the network. While the specific exploitation requirements depend on the application implementation, the underlying flaw is inherent to the RadImageEditor's state handling logic. Post-exploitation, an attacker can gain deep visibility into the host environment, potentially identifying credentials, database connection strings, or system environment configurations that facilitate further compromise of the web server infrastructure.\nThe vulnerability affects all Telerik UI for AJAX versions prior to 2026.3.812. No remediation exists within these versions other than updating to the secure version specified by Progress Software."
}