Telerik UI Unauthenticated RCE via File Read Chain

Tanto Security has disclosed a critical exploit chain affecting Telerik UI for ASP.NET AJAX versions 2011.2.712 through 2026.2.708. By exploiting an arbitrary file read in the RadImageEditor control, unauthenticated attackers can retrieve sensitive configuration files like `web.config`.

If these configurations contain static `machineKey` or `DialogParametersEncryptionKey` values—both of which are recommended for production environments—the attacker can escalate to Remote Code Execution (RCE). RCE is achieved either through forged ViewState deserialization or by hijacking the RadEditor DocumentManager to perform unrestricted file uploads of webshells directly into the web root. This poses a severe risk to any application utilizing these components, potentially leading to full system compromise.