{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/telerik-ui-for-.net-maui--16.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:telerik_ui_for_net_maui:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-124705"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Telerik UI for .NET MAUI (\u003c 16.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Telerik UI for .NET MAUI prior to version 16.0.0 is susceptible to an untrusted URL redirection vulnerability identified as CVE-2026-124705. The flaw resides within the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling mechanisms. This issue enables an unauthenticated attacker to supply a crafted document or PDF file containing a non-allowlisted URI scheme. When a user interacts with these components to open the malicious link, the application executes arbitrary operating system protocol handlers with attacker-specified arguments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to launch arbitrary OS protocol handlers on the user's machine, potentially leading to unauthorized execution of system-level operations or unintended application interactions, depending on the available handlers and attacker-controlled parameters. The vulnerability has a CVSS v3.1 base score of 7.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Progress Telerik UI for .NET MAUI to version 16.0.0 or later immediately to resolve the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement strict URI scheme allowlisting for any application utilizing Telerik RadRichTextEditor or RadPdfViewer to sanitize user-provided or document-embedded links.\u003c/li\u003e\n\u003cli\u003eConduct a code review of applications integrating these Telerik components to identify how external document inputs are processed and rendered.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T14:16:54Z","date_published":"2026-11-12T14:16:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-telerik-ui-url-redirection-cve-2026-124705/","summary":"Progress Telerik UI for .NET MAUI versions prior to 16.0.0 contain an untrusted URL redirection vulnerability in RadRichTextEditor and RadPdfViewer components that allows unauthenticated attackers to execute arbitrary OS protocol handlers via malicious document links.","title":"Progress Telerik UI for .NET MAUI: URL redirection vulnerability (CVE-2026-124705)","url":"https://feed.craftedsignal.io/briefs/2026-11-telerik-ui-url-redirection-cve-2026-124705/"}],"language":"en","title":"CraftedSignal Threat Feed - Telerik UI for .NET MAUI (\u003c 16.0.0)","version":"https://jsonfeed.org/version/1.1"}