High severity · published Sep 2, 2026
CVE-2026-19219
DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Telerik UI for ASP.NET AJAX · Progress Software
2011.2.712 before 2026.3.812 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19219
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19219
www.telerik.com
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-dialoghandler-uploadpaths-tampering-cve-2026-19219
More from Telerik UI for ASP.NET AJAX
9.8
CVE-2026-6023
Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13190
PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13187
DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13186
AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13185
PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX