Medium severity5.3NVD Advisory· Published Oct 8, 2018· Updated Jun 17, 2026

CVE-2018-17060

Description

Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory. NOTE: this product has been obsolete since June 2013.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
TelerikMvcExtensionsNuGet	<= 2013.1.219	—

Affected products

Progress (organisation)/Telerik Extensions For Asp.net Mvc
cpe:2.3:a:progress:telerik_extensions_for_asp.net_mvc:*:*:*:*:*:*:*:*
ghsa-coords
pkg:nuget/telerikmvcextensions
Range: <= 2013.1.219

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-8h7p-qjv8-9mp4ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2018-17060ghsaADVISORY
www.telerik.com/support/code-library/security-alert-for-the-obsolete-telerik-extensions-for-asp-net-mvcnvdVendor AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000