Description

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-02T11:17:19.270Z",
  "pubdate": "2026-09-02T11:17:19.270Z",
  "executiveSummary": "A critical security vulnerability exists in Progress Telerik UI for AJAX, specifically within the RadEditor file browser component, affecting all versions prior to v2026.3.812.\nThe vulnerability stems from insufficient integrity protection of dialog request parameters, which are susceptible to manipulation if an attacker successfully obtains the application's encryption key material.\nBy bypassing parameter validation, a remote, unauthorized attacker can manipulate file system operations, enabling unauthorized file read, write, and upload capabilities within the server environment.\nThe successful exploitation of this flaw can lead to Remote Code Execution (RCE), granting the attacker full control over the application server.\nThis vulnerability poses a severe risk to confidentiality, integrity, and availability, necessitating immediate security updates and rigorous management of cryptographic material.",
  "technicalDetails": "The vulnerability resides within the Telerik RadEditor file browser mechanism, which utilizes encrypted parameters to dictate directory traversal and file handling operations. The root cause of this flaw is the lack of robust integrity verification for these parameters, allowing the contents of the request to be forged or altered if the underlying cryptographic keys are compromised.\nThe attack flow initiates when an attacker gains access to the application's encryption key material (e.g., machine key or specific configuration keys used for view state or parameter encryption). Once the key is obtained, the attacker can craft malicious, encrypted payloads that mirror the structure of legitimate RadEditor file browser requests.\nThese manipulated requests allow the attacker to override hardcoded directory restrictions or default folder paths associated with the file browser. By modifying the parameters that define the 'root' directory or the 'destination' path, the attacker can force the component to perform file operations outside of the intended, sandboxed environment. This essentially transforms the legitimate file browser functionality into an arbitrary file read and write tool.\nExploitation proceeds by injecting commands or malicious configuration files into directories that the web server executes or processes. If the attacker can upload a web shell or modify server-side configuration files (such as .aspx or .config files) via the compromised file browser path, they can achieve remote code execution. The browser component performs these actions under the context of the application's service account, meaning the impact of the compromise is limited only by the permissions granted to that account.\nBecause the RadEditor is a client-side component that performs server-side file operations, the lack of cryptographically signed requests (or insufficient validation of the decrypted parameters) allows the attacker to manipulate the file browser's internal logic. Without integrity checks to ensure the parameters have not been tampered with post-decryption, the application blindly trusts the manipulated input, leading to directory traversal and unauthorized file system interactions.\nThe vulnerability affects all versions of Progress Telerik UI for AJAX before v2026.3.812. The exploitation is network-accessible and does not strictly require prior authentication if the encryption material is leaked or misconfigured, and it results in a total compromise of the application's host environment."
}