---
id: CVE-2017-11357
title: >-
  Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly
  restrict user input to RadAsyncUpload, which allows remote attackers to
  perform arbitrary file uploads or execute arbitrary code.
summary: >-
  Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly
  restrict user input to RadAsyncUpload, which allows remote attackers to
  perform arbitrary file uploads or execute arbitrary code.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
  - CWE-434
vendor: progress
product: telerik_ui_for_asp.net_ajax
affected:
  - telerik_ui_for_asp.net_ajax < 2020.1.114
patched:
  - telerik_ui_for_asp.net_ajax 2020.1.114
published: '2017-08-23'
updated: '2026-08-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-11357'
references:
  - url: >-
      http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference
    label: cve@mitre.org
  - url: 'https://www.exploit-db.com/exploits/43874/'
    label: cve@mitre.org
  - url: >-
      http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.exploit-db.com/exploits/43874/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.77679
epssPercentile: 0.99556
kev: true
kevDateAdded: '2023-01-26'
kevDueDate: '2023-02-16'
kevRansomware: true
exploited: true
exploitAvailable: true
ingestedAt: '2026-08-14T06:15:27.508Z'
exploits:
  exploitdb: true
  checkedAt: '2026-09-21T15:23:35.791Z'
---

## Overview

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

## Affected

- `telerik_ui_for_asp.net_ajax < 2020.1.114`

## Remediation

Upgrade past the affected range:

- `telerik_ui_for_asp.net_ajax 2020.1.114`