New to Telerik UI for ASP.NET AJAX? Start a free 30-day trial

Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart (CVE-2026-14932)

Updated on Jul 22, 2026

Description

July 2026 - CVE-2026-14932

Progress® Telerik® UI for AJAX Q2 2026 v.2026.2.519 or earlier.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory. The scope is limited to image files (.png, .gif, .jpg, .bmp, etc.) — sensitive text files such as web.config cannot be read.

Is My Application Vulnerable?

Your application may be vulnerable if all of the following are true:

The ChartImage.axd HTTP handler is registered in web.config (this is the case whenever RadChart is used).
The handler endpoint is accessible without authentication.

Note: RadChart is an obsolete component. Customers should migrate to RadHtmlChart which does not use the ChartImage.axd handler.

Issue

CWE-321: Use of Hard-coded Cryptographic Key
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
`>= 2009.1.311` && `<= 2026.2.519` (2026 Q2)	`>= 2026.2.708` (2026 Q2 SP1)

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following measures to reduce risk.

1. Remove the ChartImage.axd handler (recommended)

If your application does not use RadChart, remove the handler registration from web.config:

xml

<!-- Remove from <system.web><httpHandlers> -->
<remove verb="*" path="ChartImage.axd" />
<add path="ChartImage.axd" type="Telerik.Web.UI.ChartHttpHandler" verb="*" validate="false" />

<!-- Remove from <system.webServer><handlers> -->
<remove name="ChartImage_axd" />
<add name="ChartImage_axd" path="ChartImage.axd" type="Telerik.Web.UI.ChartHttpHandler" verb="*" preCondition="integratedMode" />

2. Migrate to RadHtmlChart

RadChart is obsolete. Migrate to RadHtmlChart which renders charts client-side using SVG/Canvas and does not expose a server-side image handler.

Notes

RadChart has been obsolete since 2012. RadHtmlChart is the recommended replacement.
If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
We would like to thank the researchers at TantoSec for their responsible disclosure and cooperation.

External References

CVE-2026-14932 (Medium)

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L (6.5)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component uses a hardcoded encryption key enabling unauthenticated file read and deletion of image-extension files within the application directory.

Discoverer Credit: Marcio Almeida of TantoSec