CVE-2026-14932 MEDIUM

CVE-2026-14932: Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart

Vendor Progress Software
Product Telerik UI for ASP.NET AJAX
Weakness CWE-321
Published July 22, 2026
Last update July 22, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

What the vulnerability does

01Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.

Key dates

02Disclosure timeline

July 22, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2024-13773 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure CVE-2025-12177 Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key CVE-2023-3371 EmbedPress <= 3.7.3 - Sensitive Information Exposure CVE-2025-8625 Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution CVE-2023-3404 ProfileGrid <= 5.5.0 - Hardcoded Encryption Key