CVE-2026-14932 — Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart

CVE-2026-14932

Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart PUBLISHED

Description (CNA)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.

Affected (CNA)

Vendor / product	Versions
Progress Software / Telerik UI for ASP.NET AJAX	affected 2009.1.311 before 2026.2.708

CWE

CWE-321

References

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radchart-hardcoded-key-file-read-cve-2026-14932

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.