CVE-2026-19219: Telerik UI for AJAX RCE Vulnerability

CVE-2026-19219 Overview

CVE-2026-19219 is an integrity protection weakness in Progress® Telerik® UI for AJAX versions prior to v2026.3.812. The flaw resides in the RadEditor file browser dialog handler, which fails to adequately protect dialog request parameters. An attacker who has obtained the application's encryption key material can tamper with the folder paths used by the file browser for read, write, and upload operations. Successful exploitation can redirect uploads to attacker-controlled locations, potentially resulting in remote code execution on the underlying web server. The weakness is classified under CWE-345: Insufficient Verification of Data Authenticity.

Critical Impact
An attacker with knowledge of the application's encryption keys can tamper with RadEditor upload paths, enabling arbitrary file writes and remote code execution against affected ASP.NET AJAX web applications.

Affected Products

Progress Telerik UI for AJAX versions prior to v2026.3.812
ASP.NET Web Forms applications embedding the RadEditor control with file browser dialogs enabled
Web applications where Telerik.Web.UI dialog handlers are exposed and encryption keys have been disclosed

Discovery Timeline

2026-09-02 - CVE-2026-19219 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-19219

Vulnerability Analysis

The vulnerability affects the DialogHandler.axd component that services RadEditor file browser dialogs. The handler accepts a serialized argument containing dialog configuration, including the folder paths used for browsing and uploading files. While these parameters are encrypted, the integrity protection over the payload is insufficient. An attacker who has already obtained the machine key or Telerik dialog encryption key material can craft a valid ciphertext that alters the target folders.

Once the folder parameters are tampered, the RadEditor control uses attacker-supplied paths for its file operations. This allows the attacker to move outside the intended upload directory and write files anywhere the ASP.NET worker process has permission. Writing an executable server-side script into a virtual directory yields remote code execution.

Root Cause

The root cause is a failure to bind the encrypted dialog parameters to an integrity-verified context, mapping to CWE-345. The handler trusts decrypted values without validating that folder fields were authorized by the server for the requesting session. This assumption breaks once key material is leaked through unrelated disclosures, backup exposure, or prior compromise.

Attack Vector

Exploitation requires network access to the Telerik.Web.UI.DialogHandler.aspx endpoint and prior knowledge of the application encryption keys. The attacker constructs a modified dialogParametersEncoded payload that redefines UploadPaths, DeletePaths, or ViewPaths. Submitting the tampered request to the dialog handler causes the RadEditor file browser to operate against attacker-chosen directories. Uploading a .aspx or .ashx payload into a web-accessible path executes code under the application pool identity.

Refer to the Telerik Security Advisory CVE-2026-19219 for vendor technical details.

Detection Methods for CVE-2026-19219

Indicators of Compromise

Unexpected requests to Telerik.Web.UI.DialogHandler.aspx or DialogHandler.axd containing unusually long or malformed dialogParametersEncoded values
New .aspx, .ashx, or .asmx files appearing under directories that host RadEditor upload folders or outside their expected scope
IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe, or other interpreters shortly after dialog handler requests
Outbound network connections initiated by w3wp.exe to unfamiliar destinations following file upload events

Detection Strategies

Alert on writes to web-accessible directories by the ASP.NET worker process where file extensions match executable server-side handlers
Correlate HTTP POST requests to Telerik dialog handler endpoints with subsequent file creation events on the web server
Baseline normal RadEditor upload folder paths and flag requests that reference paths outside that baseline
Monitor for anomalous child process creation from w3wp.exe, a common indicator of ASP.NET webshell activity

Monitoring Recommendations

Enable IIS request logging with full query strings and inspect Telerik dialog handler traffic for parameter tampering patterns
Forward web server file system audit events and IIS logs to a centralized analytics platform for correlation
Track access patterns to machineKey configuration files, web.config, and backup archives that could leak key material
Review authentication and administrative access logs on web servers to identify prior compromise that may have exposed encryption keys

How to Mitigate CVE-2026-19219

Immediate Actions Required

Upgrade Progress Telerik UI for AJAX to v2026.3.812 or later on all affected web applications
Rotate ASP.NET machineKey values and any Telerik-specific dialog encryption keys, especially if key exposure is suspected
Audit web-accessible directories for unauthorized script files and remove any unexpected uploads
Restrict access to Telerik.Web.UI.DialogHandler.aspx at the reverse proxy or WAF layer to authenticated sessions only

Patch Information

Progress addressed CVE-2026-19219 in Telerik UI for AJAX v2026.3.812. The fix strengthens integrity verification of dialog request parameters so that tampering with folder fields is rejected even when the encryption key is known. Consult the Telerik Security Advisory for the complete upgrade guidance.

Workarounds

Disable the RadEditor file browser dialogs if they are not required by the application
Configure application pool identities with least-privilege permissions so upload directories cannot host executable content
Enforce IIS request filtering to block execution of dynamic handlers within upload directories using <handlers> removal rules
Deploy WAF signatures that inspect and reject anomalously large or malformed dialogParametersEncoded request values

bash

# Example IIS request filtering: prevent execution of ASP.NET handlers within upload directories
# Place this web.config inside the RadEditor upload folder
<configuration>
  <system.webServer>
    <handlers accessPolicy="Read">
      <clear />
    </handlers>
    <security>
      <requestFiltering>
        <fileExtensions allowUnlisted="false" />
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>