Progress Software Telerik UI for ASP.NET AJAX versions prior to 2026.2.708 contain a CWE-22 path traversal vulnerability in the file-based persistence storage provider. When the storage key is derived from user input, an attacker can exploit this to perform controlled deserialization, which may result in remote code execution. The vulnerability is tracked as CVE-2026-13186 and carries a CVSS 3.1 score of 8.1, indicating high impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed as of the publication date.

Successful exploitation of this vulnerability allows an unauthenticated attacker to perform path traversal via user-controlled input, leading to attacker-controlled deserialization. This can result in remote code execution on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input as storage keys in the file-based persistence storage provider. Implement strict input validation and sanitization to prevent path traversal. Monitor vendor channels for updates and apply patches promptly once released.