# URL Redirection to Untrusted Site Vulnerability (CVE-2026-124705)

## Description

November 2026 - [CVE-2026-124705](https://www.cve.org/CVERecord?id=CVE-2026-124705)

* Progress® Telerik® UI for .NET MAUI (RadRichTextEditor and RadPdfViewer), versions `>= 5.2.0` and `< 16.0.0`.

### What Are the Impacts

In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.

## Issue

* CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
* CAPEC-194: Fake the Source of Data

## Solution

The issue is fixed in version 16.0.0. The Progress Telerik team strongly recommends upgrading to this version or later.

| Current Version           | Update to   |
| ------------------------- | ----------- |
| `>= 5.2.0` and `< 16.0.0` | `>= 16.0.0` |

After upgrading, RadRichTextEditor and RadPdfViewer launch only links with the `http`, `https`, `mailto` and `tel` schemes by default. Links with other schemes are not opened. To open a link with another scheme, handle the `HyperlinkOpening` event of RadRichTextEditor or the `LinkAnnotationTapped` event of RadPdfViewer, set `Handled` to `true` and launch the URI from the application. RadPdfViewer also exposes the `LinkAnnotationTappedEventArgs.IsUriTrusted` property to allow or block a link.

All customers who have a license for Progress® Telerik® UI for .NET MAUI can access their downloads here: [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Mitigation

If you cannot upgrade immediately, handle the `LinkAnnotationTapped` event of RadPdfViewer, set `Handled` to `true` and launch only URIs with trusted schemes (`http`, `https`, `mailto`, `tel`). RadRichTextEditor does not expose an equivalent event in the affected versions, so avoid opening documents from untrusted sources in it.

## Notes

* If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.

## External References

[CVE-2026-124705](https://www.cve.org/CVERecord?id=CVE-2026-124705) (High)

**CVSS:** 7.8

**Vector:** `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.