CVE-2026-13181— RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Telerik UI for ASP.NET AJAX | 2010.1.309< 2026.2.708 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13181
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5
Vulnerability Title
Progress Software Progress Telerik UI for AJAX 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress Telerik UI for AJAX是Progress Software公司的一套Web界面组件库。 Progress Software Progress Telerik UI for AJAX 2026.2.708之前版本存在代码注入漏洞，该漏洞源于伪造的上传元数据影响AsyncUploadTypeName处理并触发不安全的攻击者控制类型解析，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Telerik UI for ASP.NET AJAX | 2010.1.309 ~ 2026.2.708 | - |
II. Public POCs for CVE-2026-13181
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13181
请登录查看更多情报信息。
Vendor Pages for CVE-2026-13181 (1)
Same Patch Batch · Progress Software · 2026-07-22 · 13 CVEs total
| CVE-2026-13185 | 8.1 HIGH | PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX |
| CVE-2026-13187 | 8.1 HIGH | DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX |
| CVE-2026-13186 | 8.1 HIGH | AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP. |
| CVE-2026-13190 | 8.1 HIGH | PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX |
| CVE-2026-13189 | 7.5 HIGH | SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJA |
| CVE-2026-13184 | 7.5 HIGH | RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX |
| CVE-2026-13182 | 7.5 HIGH | RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NE |
| CVE-2026-13183 | 7.5 HIGH | RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX |
| CVE-2026-14932 | 6.5 MEDIUM | Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart |
| CVE-2026-13192 | 6.5 MEDIUM | RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX |
| CVE-2026-13188 | 5.9 MEDIUM | DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX |
| CVE-2026-14865 | 5.3 MEDIUM | XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX |
IV. Related Vulnerabilities
Same product: Telerik UI for ASP.NET AJAX
- CVE-2026-14932
Unauthenticated File Read and Deletion via Hardcoded Encrypt - CVE-2026-14865
XXE Denial of Service via RadLayoutBuilder Client State in T - CVE-2026-13192
RadEditor PDF Export SSRF Vulnerability in Telerik UI for AS - CVE-2026-13190
PersistenceFramework Unsafe Type Resolution Vulnerability in - CVE-2026-13189
SpellChecker DictionaryLanguage Path Traversal Vulnerability
Same vendor: Progress Software
- CVE-2026-14932
Unauthenticated File Read and Deletion via Hardcoded Encrypt - CVE-2026-14865
XXE Denial of Service via RadLayoutBuilder Client State in T - CVE-2026-13192
RadEditor PDF Export SSRF Vulnerability in Telerik UI for AS - CVE-2026-13190
PersistenceFramework Unsafe Type Resolution Vulnerability in - CVE-2026-13189
SpellChecker DictionaryLanguage Path Traversal Vulnerability
Same weakness: CWE-470
- CVE-2026-63317
Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFa - CVE-2026-65608
Grav before 2.0.9 Remote Code Execution via FlexDirectory - CVE-2026-13187
DialogHandler Provider Type Tampering Vulnerability in Teler - CVE-2026-44174
Kirby: Arbitrary Method Call via REST API search and collect - CVE-2026-58659
PyTorch Lightning Arbitrary Code Execution via _instantiator
V. Comments for CVE-2026-13181
No comments yet