CVE-2026-18672CWE-22path-traversal

CVE-2026-18672

High · published September 2, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
28.2
In the wild
Unconfirmed
What it is

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00357 · 28.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-02T15:17Z
References (1)
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rie-path-traversal-cve-2026-18672 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:38Z
    EPSS moved — → 0%
    epss
  • 02 SEP 10:31Z
    RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX
    cvelistv5