Telerik RadImageEditor Path Traversal via Unvalidated Cache State

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-18672 is a path traversal vulnerability in Progress Telerik UI for AJAX versions before 2026.3.812 that stems from insufficient validation of client-supplied state parameters in the RadImageEditor control. An attacker can manipulate the image cache state to traverse outside intended directories and retrieve arbitrary file contents from the server. This vulnerability matters because RadImageEditor is widely deployed in enterprise web applications handling sensitive imaging workflows—exposure of files outside image directories could lead to disclosure of configuration files, credentials, or other sensitive data. Organizations using affected Telerik versions in their AJAX implementations face immediate risk of information disclosure without updating to patched versions.

Casky's 351 matched skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Discovery (TA0007) techniques. Practitioners using Casky would observe detections for CWE-22 path traversal patterns—specifically requests with manipulated cache state parameters containing directory traversal sequences like "../" or URL-encoded variants. The platform would flag anomalous RadImageEditor API calls with state values deviating from expected image metadata, reconnaissance activities probing directory structures, and file access attempts outside whitelisted image paths. Security teams would see correlated findings showing how attackers first probe application behavior (Discovery), then exploit cache state manipulation to access restricted files (Initial Access foothold for further compromise)—enabling defenders to identify exploitation attempts before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18672.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-18672

Casky has 351 skills that investigate the attack patterns behind CVE-2026-18672. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn