CVE-2026-14932 in Telerik UI for ASP.NET AJAX
Summary
by MITRE • 07/22/2026
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability exists within the obsolete RadChart component of In Progress Telerik UI for AJAX versions prior to v2026.2.708 where the ChartImage.axd handler fails to implement proper authentication and authorization controls. This flaw allows attackers to access sensitive image files through unauthenticated requests, potentially exposing confidential data stored in the application's directory structure. The vulnerability stems from inadequate input validation and access control mechanisms within the legacy charting functionality that was deprecated but remained functional in older versions of the framework.
The technical implementation flaw resides in how the ChartImage.axd handler processes file requests without verifying user credentials or session authenticity. Attackers can exploit this by directly accessing the handler with specific parameters that bypass normal application security controls, enabling them to read arbitrary files with image extensions from the web application's directory tree. This represents a classic path traversal vulnerability where the system fails to properly sanitize file paths before processing requests, allowing unauthorized access to sensitive resources stored within the application context.
The operational impact of this vulnerability extends beyond simple information disclosure as it provides attackers with the capability to delete image files from the application directory without proper authorization. This dual nature of the vulnerability enables both data exfiltration and potential disruption of application functionality, particularly affecting applications that rely heavily on dynamic chart generation and image storage. The exploitation can result in complete compromise of the application's visual assets and potentially expose underlying system files through the unauthenticated access mechanism.
Organizations should immediately implement mitigations including disabling or removing the obsolete RadChart component from affected applications, applying the latest security patches available in version 2026.2.708 or later, and implementing proper input validation controls for all file handling mechanisms. Additionally, network-level restrictions should be enforced to limit access to the ChartImage.axd handler, and all deprecated components should undergo thorough security review processes. This vulnerability aligns with CWE-22 Path Traversal and CWE-285 Improper Authorization categories within the Common Weakness Enumeration framework, while also mapping to ATT&CK technique T1213 Data from Information Repositories for information gathering activities and T1490 Inhibit System Recovery for potential disruption capabilities.