This vulnerability (CVE-2026-13189) in Progress Software's Telerik UI for ASP.NET AJAX involves improper validation of the language parameter in the spell check handler. This flaw allows an attacker to manipulate server-side file path resolution, leading to absolute path traversal. The affected version explicitly identified is 2011.2.712. The vulnerability is classified under CWE-36 (Absolute Path Traversal). The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An attacker exploiting this vulnerability can influence server-side file path resolution, potentially causing the server to process unintended file paths. This may lead to unauthorized disclosure of sensitive files or data on the server, impacting confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.