In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.
Weakness
The product uses a hard-coded, unchangeable cryptographic key.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Telerik_ui_for_asp.net_ajax | Progress | 2010.1309 (including) | 2026.2.708 (excluding) |