CVE-2026-13181 is a vulnerability in Progress Software Telerik UI for ASP.NET AJAX before version 2026.2.708. It arises from the unsafe handling of forged upload metadata that affects the AsyncUploadTypeName processing. This allows an attacker to control type resolution, potentially leading to remote code execution. The vulnerability is categorized under CWE-470, which involves the use of externally-controlled input to select classes or code, creating a critical security risk. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction for exploitation. No official patch or remediation level has been disclosed yet.

Successful exploitation of this vulnerability can lead to remote code execution, allowing an attacker to execute arbitrary code on the affected system. This compromises confidentiality, integrity, and availability of the system running Telerik UI for ASP.NET AJAX. The vulnerability can be exploited remotely without authentication or user interaction, making it a significant risk for affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Progress Software's advisories for updates. Until a fix is available, consider restricting access to affected components and validating or sanitizing upload metadata if possible to reduce exposure.