CVE-2026-13192 in Telerik UI for ASP.NET AJAX
Summary
by MITRE • 07/22/2026
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability exists within In Progress Telerik UI for AJAX framework version prior to v2026.2.708, specifically affecting the RadEditor PDF export functionality. This security flaw represents a server-side request forgery vulnerability that allows authenticated attackers to manipulate the export process and initiate connections to arbitrary external hosts. The issue stems from inadequate input validation mechanisms within the PDF export component, which fails to properly sanitize or verify the content being processed during document generation.
The technical implementation of this vulnerability leverages the RadEditor's ability to convert HTML content into PDF format, where the export feature does not sufficiently validate URLs or network references embedded within the source content. When an authenticated user submits content containing malicious references or external resource calls, the system processes these without proper validation, leading to outbound network requests that can be directed to any host accessible from the server. This behavior creates a significant attack surface where attackers can potentially exfiltrate sensitive data or gain insights into internal network structures.
From an operational impact perspective, this vulnerability poses multiple security risks including potential credential exposure through Windows authentication mechanisms, unauthorized network reconnaissance activities, and possible data leakage. The outbound connections initiated by the vulnerable component could expose internal systems to external threat actors who might leverage this capability for further attack progression. The risk is particularly elevated in environments where the application server has access to sensitive internal resources or where Windows authentication is used for system access controls.
Security mitigations should focus on implementing strict input validation and content sanitization within the RadEditor PDF export functionality, ensuring that all external resource references are properly filtered and validated before processing. Organizations should upgrade to the patched version v2026.2.708 or later, which includes enhanced validation mechanisms for the export feature. Network-level restrictions can be implemented to limit outbound connections from the application server, while also monitoring for unusual network activity patterns that might indicate exploitation attempts. This vulnerability aligns with CWE-918 Server-Side Request Forgery and maps to ATT&CK technique T1071.004 Application Layer Protocol: DNS, indicating potential reconnaissance activities through DNS queries initiated by the vulnerable component.