Executive brief
Telerik UI for ASP.NET AJAX is a suite of UI components used to build web applications. A vulnerability in the older RadChart component allows an unauthenticated attacker to remotely read or delete image files (such as .png or .jpg) from the application's server directory. While sensitive configuration files like web.config are not accessible, this could lead to data loss or unauthorized access to proprietary images.
Technical details
The vulnerability exists in the ChartImage.axd HTTP handler of the obsolete RadChart component. It is caused by the use of a hardcoded cryptographic key (CWE-321) combined with improper path limitation (CWE-22). An unauthenticated remote attacker can exploit this to read or delete files with image extensions (.png, .gif, .jpg, .bmp) within the application directory. The attack is possible if the handler is registered in the web.config and accessible over the network. The issue is resolved in version 2026.2.708; users are advised to upgrade or migrate to RadHtmlChart.
Affected products
- Progress Software Telerik UI for ASP.NET AJAX >= 2009.1.311, <= 2026.2.519
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched