A path traversal flaw in the AppDataStorageProvider of Progress Software’s Telerik UI for ASP.NET AJAX allows a malicious actor to influence the storage key used by the file‑based persistence system. Because the key is user controllable, an attacker can trigger deserialization of arbitrary data, which the framework will then execute on the server. The weakness is a classic path traversal condition, CWE‑22, that directly enables remote code execution once the attacker supplies a crafted input and the application processes it.

The vulnerability affects Progress Software’s Telerik UI for ASP.NET AJAX releases prior to version 2026.2.708. Systems running v2026.2.707 or earlier are in risk, while versions 2026.2.708 and beyond contain the mitigated code.

The CVSS score of 8.1 indicates high severity. The EPSS score of <1% indicates a very low exploitation probability, but the presence of the flaw still represents a significant security risk. It is not listed in CISA’s KEV catalog, but the nature of the vulnerability—attacker‑controlled deserialization leading to remote code execution—means that exploitation is likely if an attacker can reach the vulnerable endpoint. The most probable attack vector involves a crafted request that supplies a malicious storage key, which is then processed by the application’s persistence layer.