CVE-2026-18672

highCVSS 7.5covered by 2 sourcesfirst seen 2026-09-02

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

CSIRTS triage

What: Path traversal in RadImageEditor and parameter tampering in DialogHandler UploadPaths functionality.
Who is affected: Telerik UI for ASP.NET AJAX versions before 2026.3.812.
Urgency: Severity unknown; update should be applied as soon as available.
Action: Update Telerik UI for ASP.NET AJAX to version 2026.3.812 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-18672

Get an email if CVE-2026-18672 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (2)

unknownProgress Software security advisory (AV26-875)cccs · 2026-09-02
highCVE-2026-18672: In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supp…nvd · 2026-09-02

External references

NVD record for CVE-2026-18672

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-18672 status](https://www.csirts.com/badge/CVE-2026-18672)](https://www.csirts.com/cve/CVE-2026-18672)