CVE-2026-18672: CWE-22 Path Traversal in Progress Software Telerik UI for ASP.NET AJAX

In Progress Telerik UI for ASP.NET AJAX prior to version 2026.3.812, the RadImageEditor control does not sufficiently validate client-supplied state parameters. This insufficient validation can be exploited to perform a path traversal attack, allowing an attacker to influence which file is returned by the control's image cache. As a result, files outside the intended image directories may be exposed to the attacker. The vulnerability is identified as CWE-22 (Path Traversal) and affects version 2011.2.712 of Telerik UI for ASP.NET AJAX. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating that the vulnerability is remotely exploitable without privileges or user interaction and can lead to high impact on confidentiality. There is no vendor advisory or patch currently available, and no known exploits have been reported in the wild.

An attacker can exploit this vulnerability to read files outside the intended image directories by manipulating the client-supplied state in the RadImageEditor control. This can lead to unauthorized disclosure of sensitive file contents. The vulnerability does not affect integrity or availability but has a high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected component or implementing additional input validation and access controls to mitigate potential exploitation.