PT-2026-63395

CVE-2026-13181

Published

2026-07-22

Updated

2026-09-18

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708

Description Forged upload metadata can influence the processing of AsyncUploadTypeName, leading to unsafe attacker-controlled type resolution. This flaw allows for remote code execution in affected deployments.

Recommendations Update Telerik UI for AJAX to version 2026.2.708 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\'Unsafe Reflection\')

Related identifiers

CVE-2026-13181

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com