URL Redirection to Untrusted Site Vulnerability (CVE-2026-124705)
Description
November 2026 - CVE-2026-124705
- Progress® Telerik® UI for .NET MAUI (RadRichTextEditor and RadPdfViewer), versions
>= 5.2.0and< 16.0.0.
What Are the Impacts
In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.
Issue
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- CAPEC-194: Fake the Source of Data
Solution
The issue is fixed in version 16.0.0. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= 5.2.0 and < 16.0.0 | >= 16.0.0 |
After upgrading, RadRichTextEditor and RadPdfViewer launch only links with the http, https, mailto and tel schemes by default. Links with other schemes are not opened. To open a link with another scheme, handle the HyperlinkOpening event of RadRichTextEditor or the LinkAnnotationTapped event of RadPdfViewer, set Handled to true and launch the URI from the application. RadPdfViewer also exposes the LinkAnnotationTappedEventArgs.IsUriTrusted property to allow or block a link.
All customers who have a license for Progress® Telerik® UI for .NET MAUI can access their downloads here: Product Downloads | Your Account.
Mitigation
If you cannot upgrade immediately, handle the LinkAnnotationTapped event of RadPdfViewer, set Handled to true and launch only URIs with trusted schemes (http, https, mailto, tel). RadRichTextEditor does not expose an equivalent event in the affected versions, so avoid opening documents from untrusted sources in it.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-124705 (High)
CVSS: 7.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.