---
id: "CVE-2017-11317"
kind: "vulnerability"
aliases: ["CVE-2017-11317"]
title: "Telerik User Interface (UI) for ASP.NET AJAX: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.84175
exploited: true
status: "open"
category: "package"
products: [{"name": "Telerik User Interface (UI) for ASP.NET AJAX", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["asp.net", "exploited", "iis", "package", "telerik", "windows"]
not_affected_if: ["unknown"]
published_at: "2017-08-23T17:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-11317", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-11317", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11317", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Telerik User Interface (UI) for ASP.NET AJAX: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability

Telerik UI for ASP.NET AJAX (Telerik.Web.UI) has an unrestricted file upload flaw that lets remote attackers upload arbitrary files. The sources say the flaw can also lead to arbitrary code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Telerik User Interface (UI) for ASP.NET AJAX affected ? fixed ?

## How to check

Find Telerik.Web.UI.dll in your ASP.NET application bins and check its version against the vendor advisory; the sources do not give a specific version range.

## Fix

Upgrade Telerik UI for ASP.NET AJAX to a patched release per the vendor instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-11317
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-11317
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-11317

## From the sources

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_