HIGH 7.5 NVD

CVE-2026-18672

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence wh

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rie-

Published: 2026-09-02 · Source: NVD · Feed updated: 2026-09-02

This high severity vulnerability with a CVSS score of 7.5 was published on 2026-09-02 via NVD.

vulnfeed aggregates 11639 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.