SpellChecker DictionaryLanguage Path Traversal Vulnerability (CVE-2026-13189)
Description
June 2026 - CVE-2026-13189
- Progress® Telerik® UI for AJAX 2026.2.519 or earlier.
What Are the Impacts
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the spell check handler does not validate the language parameter supplied in the request, which may allow an attacker to influence server-side file path resolution and trigger unintended server-side network requests.
Is My Application Vulnerable?
Your application may be vulnerable if all of the following are true:
RadSpellis used in the application.- The application has not been upgraded to a patched version — see the Solution section below.
Issue
- CWE-36: Absolute Path Traversal
- CAPEC-126: Path Traversal
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 2011.2.712 && <= 2026.2.519 (2026 Q2) | >= 2026.2.708 (2026 Q2 SP1) |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- We would like to thank the researchers at Code White Security GmbH and TantoSec for their responsible disclosure and cooperation.
External References
CVE-2026-13189 (High)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of a request parameter in the spell check handler may allow file path manipulation on the server.
Discoverer Credit: Markus Wulftange with CODE WHITE GmbH, Marcio Almeida of TantoSec