Telerik UI for ASP.NET AJAX: From Reading web.config to Unauthenticated RCE
Attack Techniques & Methods2026-10-29, 13:04
Researchers at Tanto Security demonstrated two-vulnerability chain in Telerik UI for ASP.NET AJAX that can lead to unauthenticated remote code execution under certain configurations.
• CVE-2026-18672 — Arbitrary File Read via RadImageEditor
The editor's state is stored in a hidden
<ClientID>_ClientState field as unsigned, unencrypted JSON. During a postback, the server accepts an attacker-controlled imageUrl and caches the file path in HttpRuntime.Cache under a newly generated GUID.
The client then receives an encrypted _downloadKey. By submitting it to Telerik.Web.UI.WebResource.axd?type=iec&dkey=3, the attacker causes ImageEditorCacheHandler to retrieve the cached path and return the file contents.
In their PoC, the researchers read web.config using the application-relative path ~/web.config. This resolves correctly in both the initial file-access check and the cache handler, which otherwise interpret relative paths from different base directories.
When ImageManager.EnableContentProvider is enabled, the target file must exist; otherwise, the request fails before the path is cached. The ImageEditor dialog within RadEditor exposes the same mechanism without requiring a separate publicly accessible RadImageEditor page.• CVE-2026-19219 — Upload Path Manipulation in RadEditor
The disclosed
web.config may contain Telerik.Web.UI.DialogParametersEncryptionKey or a static ASP.NET machineKey. Neither is explicitly configured by default, so escalating the file read to RCE depends on the application's configuration.
Using the recovered key, an attacker decrypts and forges the encrypted dialog parameters (dp, carried in dialogParametersHolder), setting ViewPaths and UploadPaths to ~/, changing SearchPatterns to ., and increasing MaxUploadFileSize.
DialogParametersSerializer.Deserialize() accepts these values without independently validating the permitted directories. Submitting the forged parameters to DialogHandler.aspx?DialogName=DocumentManager opens RadFileExplorer with attacker-controlled paths. Uploading through WebResource.axd?type=rau can then place an .aspx web shell in the application root if the IIS worker process has sufficient write permissions.
In a PoC against Telerik 2026.2.708, the researchers executed whoami as iis apppool\telerikpool-v708.• Alternative RCE Path — ASP.NET ViewState
If a static
machineKey is exposed, an attacker can forge a correctly authenticated __VIEWSTATE payload containing a TextFormattingRunProperties → XamlReader.Parse → ObjectDataProvider → Process.Start deserialization chain.
The PoC used this chain to write a web shell. CVE-2026-19219 is not required for this path. When no separate DialogParametersEncryptionKey is configured, the same machineKey can also be used to forge the dialog's upload parameters.File disclosure does not automatically imply RCE. The demonstrated chains require a static
machineKey or DialogParametersEncryptionKey. Deploying a web shell additionally requires write access to the target directory.Affected versions: Telerik UI for ASP.NET AJAX 2011.2.712–2026.2.708, inclusive. Version 2026.3.812 added path and extension validation for file reads, encrypted image paths in the client state, and blocked uploads of dangerous extensions, including
.aspx, .ashx, .exe, and .dll. However, Telerik.Web.UI.FileBrowserAllowedPaths remains optional. Without it, an attacker who possesses a valid dialog encryption key can still select attacker-chosen upload directories accessible to the application, although dangerous file extensions are blocked. In addition to upgrading to 2026.3.812 or later, administrators should explicitly configure FileBrowserAllowedPaths, restrict write permissions for the IIS application pool, and disable script execution in upload directories. If web.config may have been exposed, its secrets should be rotated.