RadImageEditor Path Traversal Vulnerability (CVE-2026-18672)
Description
August 2026 - CVE-2026-18672
- Progress® Telerik® UI for AJAX 2026.2.708 or earlier.
What Are the Impacts
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.
Is My Application Vulnerable?
Your application is potentially affected if RadImageEditor is used in it, either as a standalone control or through RadEditor's built-in Image Editor tool, which hosts a RadImageEditor instance internally. There is no configuration that mitigates this issue prior to upgrading.
Issue
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CAPEC-126: Path Traversal
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 2011.2.712 && <= 2026.2.708 (2026 Q2) | >= 2026.3.812 (2026 Q3) |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- We would like to thank the researchers at TantoSec for their responsible disclosure and cooperation.
External References
CVE-2026-18672 (High)
CVSS: 7.5 / High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in RadImageEditor may allow an unauthenticated attacker to read file contents outside the intended image directories.
Discoverer Credit: Marcio Almeida of TantoSec