In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart components ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.
Weakness
The product uses a hard-coded, unchangeable cryptographic key.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Telerik_ui_for_asp.net_ajax | Progress | 2009.1311 (including) | 2026.2.708 (excluding) |