DialogHandler UploadPaths Tampering Vulnerability (CVE-2026-19219)

Updated on Sep 2, 2026

Description

August 2026 - CVE-2026-19219

• Progress® Telerik® UI for AJAX 2026.2.708 or earlier.

What Are the Impacts

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by RadEditor's built-in file browser dialogs may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

Is My Application Vulnerable?

Your application may be vulnerable if all of the following are true:

• RadEditor is used in the application with its built-in file browser dialogs enabled.
• Telerik.Web.UI.DialogParametersEncryptionKey is set to a custom value in web.config, or machineKey is explicitly configured with a static value (rather than left on the AutoGenerate default), and that key material has been exposed or recovered by other means.

Applications left on the default AutoGenerate machineKey with no custom DialogParametersEncryptionKey configured are not remotely forgeable through this vector.

Issue

• CWE-345: Insufficient Verification of Data Authenticity
• CWE-434: Unrestricted Upload of File with Dangerous Type
• CAPEC-153: Input Data Manipulation

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2011.2.712 && <= 2026.2.708 (2026 Q2 SP2)	>= 2026.3.812 (2026 Q3)

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.

Mitigation

The measures below reduce risk but do not fully close this issue; upgrading is the only remediation that fully addresses it.

• Confirm the application pool identity does not have write access to the web application root, and disable script execution on any folder it can write to.
• Remove the affected RadEditor controls, or disable their file browser dialogs, from the page(s) until you can upgrade.
• If the RadEditor's dialog/file-browser functionality is not required by your application, disable the dialog handler Telerik.Web.UI.DialogHandler.aspx in the web.config
  xml

  <system.web>
       <httpHandlers>
            <!-- Remove or comment the following line -->
            <add path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" verb="*" validate="false" />
       </httpHandlers>
  </system.web>
  <system.webServer>
       <handlers>
            <!-- Ensure you have this line -->
            <remove name="Telerik_Web_UI_DialogHandler_aspx" />
            <!-- Remove or comment the following line -->
            <add name="Telerik_Web_UI_DialogHandler_aspx" path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" verb="*" preCondition="integratedMode" />
       </handlers>
  </system.webServer>

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank the researchers at TantoSec for their responsible disclosure and cooperation.

External References

CVE-2026-19219 (High)

CVSS: 8.1 / High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters may allow an attacker with certain application key material to influence server-side file operations, which can lead to remote code execution.

Discoverer Credit: Marcio Almeida of TantoSec