CVE-2026-14932: Telerik UI AJAX Information Disclosure

CVE-2026-14932 Overview

CVE-2026-14932 affects Progress Telerik UI for AJAX versions prior to v2026.2.708. The vulnerability resides in the obsolete RadChart component's ChartImage.axd handler. Unauthenticated attackers can read and delete image-extension files within the application directory by abusing this handler. The root cause is tied to a hardcoded cryptographic key [CWE-321] used by the legacy chart component, which allows attackers to forge valid requests without authentication.

Critical Impact
Unauthenticated network attackers can read and delete image-extension files from the application directory of affected Telerik UI for AJAX deployments.

Affected Products

Progress Telerik UI for AJAX versions prior to v2026.2.708
Applications embedding the obsolete RadChart component
ASP.NET web applications exposing the ChartImage.axd HTTP handler

Discovery Timeline

2026-07-22 - CVE-2026-14932 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-14932

Vulnerability Analysis

The RadChart control is a deprecated charting component in Telerik UI for AJAX. It exposes an HTTP handler at ChartImage.axd that serves rendered chart images from the application directory. The handler validates requests using a cryptographic token derived from a hardcoded key shipped inside the Telerik assemblies.

Because the key is static and known, attackers can craft valid tokens without possessing any secret material specific to the target deployment. The handler accepts these forged requests and performs file system operations against paths supplied in the request parameters. Attackers can retrieve image-extension files or trigger their deletion inside the web application directory.

The issue is scoped to files matching image extensions, which limits the direct exposure of arbitrary source code or configuration files. However, deletion of image assets can degrade application availability, and read access to cached chart images may leak sensitive rendered data.

Root Cause

The vulnerability stems from use of a hardcoded cryptographic key [CWE-321] inside the RadChart component. The key was intended to authenticate legitimate ChartImage.axd requests. Because the key ships with the product, any actor with access to the assemblies can generate valid tokens and bypass the intended access control.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to the ChartImage.axd endpoint over the network. The requests contain forged authentication tokens computed with the hardcoded key and reference target image files by path or identifier. The handler processes the request and returns file contents or deletes the referenced file. No user interaction and no prior authentication are required. See the Telerik Security Advisory for CVE-2026-14932 for vendor-supplied technical detail.

Detection Methods for CVE-2026-14932

Indicators of Compromise

Unexpected HTTP GET requests to ChartImage.axd from external or unusual source addresses
Missing or truncated image files in the application directory without a corresponding deployment change
Web server logs showing ChartImage.axd traffic in applications that no longer use the RadChart component

Detection Strategies

Inventory IIS and ASP.NET applications for references to Telerik.Web.UI.dll and enumerate any registration of the ChartImage.axd handler in web.config
Alert on request patterns to ChartImage.axd containing base64-encoded or query-encoded parameters that reference file paths
Compare file system snapshots of image directories against baseline to detect unauthorized deletions

Monitoring Recommendations

Forward IIS access logs to a centralized log platform and build queries for ChartImage.axd request volume anomalies
Track HTTP 200 and 404 responses from the handler to identify probing activity
Monitor file integrity for image assets served by Telerik-backed applications

How to Mitigate CVE-2026-14932

Immediate Actions Required

Upgrade Progress Telerik UI for AJAX to version 2026.2.708 or later
Remove the ChartImage.axd handler registration from web.config if RadChart is not used
Restrict network access to affected applications until the patch is applied
Audit the application directory for missing or unexpected image files

Patch Information

Progress addresses CVE-2026-14932 in Telerik UI for AJAX v2026.2.708. Apply the vendor update by replacing the deployed Telerik.Web.UI assemblies and validating that dependent applications continue to function. Refer to the Telerik Security Advisory for CVE-2026-14932 for authoritative upgrade guidance.

Workarounds

Unregister the ChartImage.axd HTTP handler in web.config when the RadChart component is not required by the application
Deploy a web application firewall rule that blocks external requests to ChartImage.axd
Apply URL authorization rules in IIS to require authentication for the affected handler path

bash

# Configuration example: remove the RadChart handler in web.config
# <system.webServer>
#   <handlers>
#     <remove name="ChartImage_axd" />
#   </handlers>
# </system.webServer>