CVE-2026-13192

Published: Jul 22, 2026Modified: Aug 6, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security@progress.com (Secondary)

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.

Affected (1)

Products: Progress: Telerik Ui For Asp.net Ajax

1 product

Telerik Ui For Asp.net Ajax

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Progress Telerik Ui For Asp.net Ajax	From 2008.31314 to 2026.2.708

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radeditor-pdf-export-ssrf-CVE-2026-13192

Source: security@progress.com

Vendor AdvisoryMitigation

Timeline

No history available yet.