New to Telerik UI for ASP.NET AJAX? Start a free 30-day trial

RadEditor PDF Export SSRF Vulnerability (CVE-2026-13192)

Updated on Jul 22, 2026

Description

June 2026 - CVE-2026-13192

Progress® Telerik® UI for AJAX versions from 2008.3.1314 through 2026.2.519.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the RadEditor PDF export feature does not sufficiently validate the content submitted for export. An authenticated attacker can cause the server to make outbound network requests to arbitrary hosts, potentially resulting in exposure of Windows authentication credentials and internal network reconnaissance.

Is My Application Vulnerable?

Your application may be vulnerable if all of the following are true:

RadEditor is used in the application with PDF export enabled.
Users can submit arbitrary content to the editor (including untrusted or authenticated users).
The application has not been upgraded to a patched version — see the Solution section below.

Issue

CWE-918: Server-Side Request Forgery (SSRF)
CAPEC-664: Server-Side Request Forgery

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
`>= 2008.3.1314` && `<= 2026.2.519` (2026 Q2)	`>= 2026.2.708` (2026 Q2 SP1)

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following measures to reduce risk:

Require authentication for PDF export pages. Ensure that any page hosting a RadEditor with PDF export enabled is not publicly accessible. Restrict access to authenticated and authorized users only.
Disable the PDF export feature if not required. Remove or disable the PDF export button and server-side export handler in applications where PDF export functionality is not needed.
Sanitize content before calling ExportToPdf(). In the server-side handler that triggers the PDF export (e.g. the Button_Click event), strip or replace dangerous URL schemes (file://, UNC paths, and non-HTTPS URLs) from image src attributes in RadEditor.Content before invoking ExportToPdf().
Use an external PDF conversion library instead of the built-in export engine. Replace the default Apoc-based PDF export with the Document Processing Library (DPL) or another external HTML-to-PDF library that does not perform server-side network requests to resolve image URLs.

Notes

If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
Ensure all PDF export endpoints require authentication.
We would like to thank Marcio Almeida of TantoSec for their responsible disclosure and cooperation.

External References

CVE-2026-13192 (Medium)

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.

Discoverer Credit: Marcio Almeida of TantoSec