Vulnerability · Published Sep 2, 2026 · Assigned by ProgressSoftware

CVE-2026-19219DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX

High 8.1

In plain English

A high-severity insufficient verification of data authenticity in Telerik UI for ASP.NET AJAX from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.2%top 88.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Telerik UI for ASP.NET AJAX	2011.2.712 – before 2026.3.812

Weakness: CWE-345, CWE-434 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-dialoghandler-uploadpaths-tampering-cve-2026-19219 vendor-advisory