CVE-2026-13189
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In Progress Telerik UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
Risk Assessment
An attacker could access unauthorized files or trigger unintended requests, potentially leading to data leakage or privilege escalation.
Recommendation
Immediately upgrade to version 2026.2.708 or later, which includes a fix for the language parameter validation.
Other vulnerabilities in Progress Telerik UI for AJAX
See all- CVE-2026-6023High
The RadFilter control in Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421 is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client.
- CVE-2026-13190High
A deserialization vulnerability in Progress Telerik UI for AJAX (prior to v2026.2.708) allows unsafe type instantiation from attacker-influenced persisted state.
- CVE-2026-13185High
In Progress Telerik UI for AJAX (prior to v2026.2.708), applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content.
- CVE-2026-13181High
In Progress Telerik UI for AJAX (prior to v2026.2.708), forged upload metadata influences AsyncUploadTypeName processing, enabling unsafe type resolution.
Original NVD description (English source)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.