CVE-2026-19219: CWE-345 Insufficient Verification of Data Authenticity in Progress Software Telerik UI for ASP.NET AJAX

This vulnerability (CVE-2026-19219) affects Progress Software Telerik UI for ASP.NET AJAX versions prior to 2026.3.812. It stems from insufficient verification of data authenticity (CWE-345) in the dialog request parameters used by the RadEditor file browser. If an attacker obtains specific application encryption key material, they can alter the directories the file browser reads from, writes to, and uploads into. This manipulation can potentially result in remote code execution on the affected system. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker who has obtained certain encryption key material to manipulate file browser directories, potentially leading to remote code execution. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to encryption key material and monitor for unauthorized access attempts related to the RadEditor file browser.