Executive brief
Progress Telerik UI for AJAX is a web development framework that includes a rich text editor (RadEditor) with built-in file browser dialogs. An attacker who obtains the application's encryption keys can tamper with file browser parameters to alter which folders are accessible for reading, writing, and uploading files. This could allow an attacker to place malicious code on the server and achieve remote code execution.
Technical details
The vulnerability stems from insufficient integrity protection (CWE-345) of dialog request parameters used by RadEditor's file browser dialogs. Specifically, the DialogHandler component fails to properly authenticate or sign request parameters, allowing an attacker with access to the application's encryption keys (either a custom DialogParametersEncryptionKey or a static machineKey) to forge or modify dialog requests. An attacker can alter the folder paths that the file browser reads from, writes to, and uploads into, combined with unrestricted file upload (CWE-434), leading to arbitrary file placement and remote code execution. The attack requires network access and knowledge of the encryption key material, but no authentication or user interaction. Applications using the default AutoGenerate machineKey without a custom DialogParametersEncryptionKey are not affected.
Affected products
- Progress Telerik UI for AJAX prior to 2026.3.812
Timeline
- 2026-09-02: disclosed