CVE-2026-13186
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution.
CVSS score8.1 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-22
Vendorsprogress
Affected products
| Vendors | Product | Versions |
|---|---|---|
| progress | telerik ui for asp.net ajax | < 2026.2.708 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.