CVE-2026-13189

Analyzed Analyzed - Analysis Complete

Insufficient Input Validation in Telerik UI for AJAX Leads to Path Traversal

Publication date: 2026-07-22

Last updated on: 2026-08-06

Assigner: Progress Software Corporation

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13189

EUVD

EUVD-2026-47694

Affected Vendors & Products

Vendor	Product	Version / Range
progress	telerik_ui_for_asp.net_ajax	From 2011.2712 (inc) to 2026.2.708 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-36	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Progress Telerik UI for AJAX versions prior to v2026.2.708. It involves insufficient validation of the language parameter in the spell check handler, which could allow an attacker to manipulate server-side file path resolution and trigger unintended server requests.

Detection Guidance

Check if your Telerik UI for AJAX version is prior to v2026.2.708. Inspect server logs for unusual file path requests in the spell check handler, particularly those containing path traversal sequences like '../'.

Impact Analysis

An attacker could exploit this to access sensitive files on the server or perform unauthorized actions through crafted requests. This may lead to data breaches, unauthorized file access, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Telerik UI for AJAX to v2026.2.708 or later. If immediate upgrade is not possible, restrict access to the spell check handler endpoint and monitor for suspicious requests.

Hi! I’m here to help you understand CVE-2026-13189. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70