AppDataStorageProvider Path Traversal Deserialization Vulnerability (CVE-2026-13186)
Description
June 2026 - CVE-2026-13186
- Progress® Telerik® UI for AJAX 2026.2.519 or earlier.
What Are the Impacts
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider allows an attacker to influence which file is loaded as persistence state, enabling attacker-controlled deserialization and remote code execution.
Is My Application Vulnerable?
Your application may be vulnerable if all of the following are true:
RadPersistenceManageruses file-based storage and the storage key can be influenced by user-controlled input (e.g. a query string parameter, form field, or cookie value).
Risk is significantly elevated if another feature in the application allows writing files to the server's App_Data directory.
Issue
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CAPEC-126: Path Traversal
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 2013.1.220 && <= 2026.2.519 (2026 Q2) | >= 2026.2.708 (2026 Q2 SP1) |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.
Mitigation
If an immediate upgrade is not possible, apply the following measures to reduce risk.
Mitigation 1 — Ensure the persistence storage key is not derived from user input
The default storage key is a fixed value and is safe. This vulnerability only affects applications that explicitly set the key to a value taken from request data (query string, form field, or cookie).
If you have not changed the key in your code, you are not affected by this specific issue.
If you do set it, ensure the value comes from server-side state only:
// Safe — hardcoded application key
PersistenceManager1.StorageProviderKey = "my-app-persistence-state";
// Safe — authenticated user identity (requires authentication, not for anonymous scenarios)
PersistenceManager1.StorageProviderKey = User.Identity.Name;
// UNSAFE — never derive from request data
// PersistenceManager1.StorageProviderKey = Request.QueryString["userId"];
// PersistenceManager1.StorageProviderKey = Request.Form["stateKey"];
// PersistenceManager1.StorageProviderKey = Request.Cookies["stateId"].Value;
Mitigation 2 — Move the RadAsyncUpload temporary folder outside App_Data (defense-in-depth)
The default upload temp directory is within App_Data. Moving it removes a well-known write location that the attack chain depends on to place files within reach of the file-based persistence storage.
Important: This is a defense-in-depth measure only. It is not a substitute for Mitigation 1. If the storage key remains user-controlled, a path traversal using relative path sequences may still reach the new directory. Always apply Mitigation 1 first.
<!-- Web.config -->
<appSettings>
<!-- ~/UploadTemp is within the app root but outside App_Data -->
<add key="Telerik.AsyncUpload.TemporaryFolder" value="~/UploadTemp" />
</appSettings>Create the
UploadTempfolder manually before deploying and ensure the application pool identity has write permissions to it.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- We would like to thank the researchers at Code White Security GmbH for their responsible disclosure and cooperation.
External References
CVE-2026-13186 (High)
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1)
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in file-based persistence storage can enable attacker-controlled deserialization and remote code execution.
Discoverer Credit: Markus Wulftange with CODE WHITE GmbH