CVE-2020-11414

Name of the Vulnerable Software and Affected Versions Progress Telerik UI for Silverlight versions prior to 2020.1.330

Description An issue was discovered in the RadUploadHandler class in RadUpload for Silverlight, where a crafted web request could result in uploads to arbitrary locations. The uploading file location should be inside the directory where the upload handler class is defined, but before version 2020.1.330, this expectation could be bypassed.

Recommendations For versions prior to 2020.1.330, update to version 2020.1.330 or later to resolve the issue. As a temporary workaround, consider restricting access to the RadUploadHandler class to minimize the risk of exploitation.