CVE-2026-13189
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Jul 22, 2026
CISA due date
—
The record
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118693 CherryTree through 1.7.2 contains a path traversal vulnerability in… CWE-36
- CVE-2026-83784 Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized… CWE-36
- CVE-2026-83683 Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized… CWE-36
- CVE-2026-89009 WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an… CWE-36
- CVE-2026-68487 Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an… CWE-36
- CVE-2026-88288 GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi… CWE-36
- CVE-2026-47606 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could… CWE-36
- CVE-2026-46345 compliance-trestle is a tooling platform for managing compliance as code. CWE-36