PT-2026-84661

CVE-2026-18672

Published

2026-09-02

Updated

2026-09-02

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.3.812

Description Insufficient validation of client-supplied state in the RadImageEditor control allows an attacker to influence which file is returned by the image cache. This can lead to the exposure of file contents located outside the intended image directories.

Recommendations Update to version 2026.3.812 or later.

Exploitability

Fix

Impacts

Researchers

Marcio Almeida

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2026-18672

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com