This vulnerability (CWE-470) arises from the use of externally-controlled input to select classes or code within Telerik UI for ASP.NET AJAX prior to version 2026.2.708. Specifically, an attacker can forge upload metadata to influence the AsyncUploadTypeName processing mechanism, leading to unsafe resolution of attacker-controlled types. This flaw can be exploited to achieve remote code execution on vulnerable systems. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution, compromising confidentiality, integrity, and availability of the affected system. This can lead to full system compromise in deployments using vulnerable versions of Telerik UI for ASP.NET AJAX.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor Progress Software advisories for updates and apply patches once available. Until then, consider restricting access to vulnerable components and closely reviewing upload metadata handling.