CVE-2026-18672 Overview
CVE-2026-18672 is a path traversal vulnerability in Progress® Telerik® UI for AJAX versions prior to v2026.3.812. The flaw resides in the RadImageEditor control, which performs insufficient validation of client-supplied state. An attacker can manipulate cached image references to influence which file the control returns. Successful exploitation exposes file contents outside the intended image directories. The issue is categorized as CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Progress has published a Telerik Security Advisory addressing the flaw in version 2026.3.812.
Critical Impact
Unauthenticated remote attackers can read arbitrary files accessible to the web application process, exposing configuration data, source code, or credentials stored on the server.
Affected Products
- Progress Telerik UI for AJAX prior to v2026.3.812
- Applications embedding the RadImageEditor control
- ASP.NET AJAX web applications shipping vulnerable Telerik assemblies
Discovery Timeline
- 2026-09-02 - CVE-2026-18672 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-18672
Vulnerability Analysis
The RadImageEditor control in Telerik UI for AJAX provides server-side image manipulation for ASP.NET applications. It maintains an image cache that references files by client-supplied state parameters. The control accepts these parameters without adequate validation, allowing an attacker to reference file paths that fall outside the intended image directory structure.
When the control resolves a cached image request, it uses the untrusted path fragments to locate content on disk. Traversal sequences in the state can redirect the lookup to arbitrary files readable by the worker process. The response returns the file contents to the caller, producing confidentiality loss without requiring authentication.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The RadImageEditor component trusts client-supplied state that identifies cached images, and it does not canonicalize or restrict the resolved path to the designated image folder. Attackers who supply crafted state values escape the intended directory boundary during file retrieval.
Attack Vector
The attack requires only network access to a page that hosts RadImageEditor. An attacker crafts a request that includes manipulated image cache state and submits it to the vulnerable endpoint. No user interaction and no prior authentication are required. Impact is limited to confidentiality; integrity and availability of the target system remain unaffected by this specific flaw. Refer to the Telerik Security Advisory for endpoint-specific technical details.
Detection Methods for CVE-2026-18672
Indicators of Compromise
- Requests to RadImageEditor handlers containing ../, ..\, encoded traversal sequences, or absolute file paths in state parameters.
- Unusually large or non-image responses returned by image cache endpoints tied to RadImageEditor.
- Access log entries for Telerik.Web.UI.WebResource.axd or image editor handlers correlated with requests for files such as web.config, appsettings.json, or files under App_Data.
Detection Strategies
- Inspect HTTP request bodies and query strings sent to RadImageEditor endpoints for path traversal patterns and URL-encoded variants.
- Monitor web server access logs for anomalous response sizes and content types returned from image editor cache handlers.
- Deploy WAF rules that reject traversal sequences and non-image extensions in parameters destined for Telerik AJAX controls.
Monitoring Recommendations
- Alert on ASP.NET worker processes reading files outside configured image directories through file integrity monitoring.
- Track outbound response payloads from Telerik endpoints for signatures of sensitive files including web.config headers and connection strings.
- Correlate anomalous scanner-like traffic patterns against pages that host RadImageEditor instances.
How to Mitigate CVE-2026-18672
Immediate Actions Required
- Upgrade Telerik UI for AJAX to version 2026.3.812 or later on all affected applications.
- Inventory ASP.NET applications for pages that embed RadImageEditor and prioritize internet-facing systems.
- Restrict filesystem permissions of the ASP.NET worker process to the minimum set required to serve the application.
Patch Information
Progress has released a fix in Telerik UI for AJAX v2026.3.812. Details and upgrade guidance are available in the Telerik Security Advisory CVE-2026-18672. Apply the update by upgrading the referenced NuGet packages or replacing the Telerik assemblies deployed with the application.
Workarounds
- Disable or remove RadImageEditor from pages where the control is not required until patching is complete.
- Deploy WAF signatures that block traversal sequences and unexpected extensions on parameters routed to Telerik handlers.
- Restrict the ASP.NET application pool identity so it cannot read sensitive files outside the web root, such as system configuration or credential stores.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
