Description
In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Progress Software | Telerik UI for ASP.NET AJAX | 2011.2.712 – < 2026.1.225 | 2026.1.225 |