CVE-2026-13192
Awaiting Analysis Awaiting Analysis - Queue

Progress Telerik UI for AJAX PDF Export Server-Side Request Forgery

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Progress Software Corporation

Description
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13192
EUVD
EUVD-2026-47697

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
progress telerik_ui_for_ajax to 2026.2.708 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Progress Telerik UI for AJAX before version 2026.2.708. It involves insufficient validation in the RadEditor PDF export feature, allowing an authenticated attacker to submit crafted content that triggers server-side requests to arbitrary hosts. This can lead to outbound network connections and potential exposure of Windows authentication credentials.

Detection Guidance

Check if your system uses Progress Telerik UI for AJAX prior to v2026.2.708. Inspect network logs for outbound connections from the RadEditor PDF export feature. Monitor for unusual server-side requests to arbitrary hosts.

Impact Analysis

An attacker could exploit this to make unauthorized outbound network requests from your server, potentially stealing Windows authentication credentials or accessing internal systems. This could lead to data breaches, unauthorized access, or further network compromise if credentials are reused.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update Progress Telerik UI for AJAX to v2026.2.708 or later. Disable the RadEditor PDF export feature if not required. Restrict outbound network connections from the server hosting the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart