CVE-2026-13186 is a path traversal vulnerability in Progress Software's Telerik UI for ASP.NET AJAX versions prior to 2026.2.708. The issue arises in the file-based persistence storage provider component, where the storage key is derived from user input without proper validation or limitation to a restricted directory. This flaw allows an attacker to traverse directories, leading to attacker-controlled deserialization and potentially remote code execution. The vulnerability has a CVSS v3.1 score of 8.1, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in remote code execution due to attacker-controlled deserialization. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability affects the file-based persistence storage provider when user input is used as a storage key without proper validation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor Progress Software advisories for updates and apply any forthcoming patches promptly. Until a fix is available, avoid using user-controlled input as storage keys in the file-based persistence storage provider or implement strict input validation and sanitization to prevent path traversal.