Dashboard / CVE-2026-6022

CVE-2026-6022

HIGH
MEDIUM Priority: 0.02 BB Relevance: 75/100
Published: 2026-04-22 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: None
A: High

Description

In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
progress telerik_ui_for_asp.net_ajax < 2026.1.421

References & Advisories (1)

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.29%
Raw Score 0.002880
Percentile 21.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00288
2026-10-28
0.00288

Intelligence Sources

nvd ref →

External Links