CVE-2017-11357

RadAsyncUpload is a built-in part of Telerik’s ASP.NET AJAX tools for uploading files. In affected versions, it doesn’t properly control what an attacker can send, which can let them upload dangerous content and potentially run it on your server—kind of like leaving a “package receiving” door unlocked, where the wrong items could be delivered.

This matters if you run an application built with telerik ui for asp.net ajax that includes file upload functionality using RadAsyncUpload. It’s only a risk when the vulnerable upload feature is reachable by an attacker (for example, from the internet) and they can send requests to it (no special access beyond reaching the endpoint).

RED. This flaw is confirmed in the CISA KEV and has been used in ransomware campaigns, so attackers have been actively targeting systems with it. Public exploits exist, making it practical for criminals to weaponize—update as a priority, not later.