CVE-2019-19790

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server through a specially crafted request. NOTE: RadChart was discontinued in 2014 in favor of RadHtmlChart. All RadChart versions were affected. To avoid this vulnerability, you must remove RadChart's HTTP handler from a web.config (its type is Telerik.Web.UI.ChartHttpHandler).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.telerik.com/devtools/aspnet-ajax/controls/chart/overviewVendor Advisory
https://www.telerik.com/forums/-620f6977edefVendor Advisory
https://www.telerik.com/forums/path-traversal-vulnerability-in-radchart-image-handlerVendor Advisory
https://docs.telerik.com/devtools/aspnet-ajax/controls/chart/overviewVendor Advisory
https://www.telerik.com/forums/-620f6977edefVendor Advisory
https://www.telerik.com/forums/path-traversal-vulnerability-in-radchart-image-handlerVendor Advisory

Timeline

Published: Dec 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-197919.8In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/RES CVE-2019-197926.7A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to ro CVE-2019-197938.8In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges.CVE-2019-197945.9The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math CVE-2019-197957.8samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file.CVE-2019-197967.8Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file.CVE-2019-197975.5read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.CVE-2019-197995.3Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via Wie CVE-2019-19805.3A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, a CVE-2019-198005.3Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelper CVE-2019-198015.5In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5)CVE-2019-198026.5In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prio