Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-14932

Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ProgressSoftware

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Progress Software Telerik UI for ASP.NET AJAX

Default version status: unaffected

  • 2009.1.311 to < 2026.2.708affected

References