---
id: "CVE-2017-11357"
kind: "vulnerability"
aliases: ["CVE-2017-11357"]
title: "Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload,\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Telerik User Interface (UI) for ASP.NET AJAX", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "progress telerik ui for asp.net ajax", "fixed": ["2020.1.114"], "affected": "< 2020.1.114", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["asp.net", "exploited", "iis", "package", "ransomware", "telerik", "windows"]
not_affected_if: ["no-telerik-ui-for-aspnet-ajax"]
published_at: "2017-08-23T17:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-11357", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11357", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload,…

Telerik UI for ASP.NET AJAX has an insecure direct object reference in its RadAsyncUpload control. An attacker can upload files to a limited location and may be able to run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Telerik User Interface (UI) for ASP.NET AJAX affected ? fixed ?
- vendor:progress telerik ui for asp.net ajax affected < 2020.1.114 fixed 2020.1.114

## Fix

Apply the vendor update per Telerik instructions; CISA's KEV entry says only 'Apply updates per vendor instructions'. Exact fixed version: unknown.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-11357
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-11357

## From the sources

Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_