{"api_version":"1","generated_at":"2026-11-12T12:53:25+00:00","cve":"CVE-2026-124705","urls":{"html":"https://cve.report/CVE-2026-124705","api":"https://cve.report/api/cve/CVE-2026-124705.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-124705","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-124705"},"summary":{"title":"URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI","description":"In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.","state":"PUBLISHED","assigner":"ProgressSoftware","published_at":"2026-11-12 12:18:22","updated_at":"2026-11-12 12:18:22"},"problem_types":["CWE-601","CWE-601 CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"],"metrics":[{"version":"3.1","source":"security@progress.com","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.telerik.com/maui-ui/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124705","name":"https://www.telerik.com/maui-ui/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124705","refsource":"security@progress.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-124705","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124705","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Progress Software","product":"Telerik UI for .NET MAUI","version":"affected 5.2.0 16.0.0 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"For RadPdfViewer, handle the LinkAnnotationTapped event, set Handled to true and launch only URIs with trusted schemes (http, https, mailto, tel). RadRichTextEditor has no equivalent event in the affected versions, so avoid loading documents from untrusted sources or upgrade to the fixed version.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Telerik UI for .NET MAUI","vendor":"Progress Software","versions":[{"lessThan":"16.0.0","status":"affected","version":"5.2.0","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.</p>"}],"value":"In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens."}],"impacts":[{"descriptions":[{"lang":"en","value":"Fake the Source of Data"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-601","description":"CWE-601 URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T11:59:34.996Z","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware"},"references":[{"tags":["vendor-advisory"],"url":"https://www.telerik.com/maui-ui/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124705"}],"source":{"discovery":"INTERNAL"},"title":"URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div>For RadPdfViewer, handle the LinkAnnotationTapped event, set Handled to true and launch only URIs with trusted schemes (http, https, mailto, tel). RadRichTextEditor has no equivalent event in the affected versions, so avoid loading documents from untrusted sources or upgrade to the fixed version.</div>"}],"value":"For RadPdfViewer, handle the LinkAnnotationTapped event, set Handled to true and launch only URIs with trusted schemes (http, https, mailto, tel). RadRichTextEditor has no equivalent event in the affected versions, so avoid loading documents from untrusted sources or upgrade to the fixed version."}],"x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","assignerShortName":"ProgressSoftware","cveId":"CVE-2026-124705","datePublished":"2026-11-12T11:59:34.996Z","dateReserved":"2026-11-09T10:41:43.933Z","dateUpdated":"2026-11-12T11:59:34.996Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 12:18:22","lastModifiedDate":"2026-11-12 12:18:22","problem_types":["CWE-601","CWE-601 CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"124705","Ordinal":"1","Title":"URL Redirection to Untrusted Site in Progress Telerik UI for .NE","CVE":"CVE-2026-124705","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"124705","Ordinal":"1","NoteData":"In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.","Type":"Description","Title":"URL Redirection to Untrusted Site in Progress Telerik UI for .NE"}]}}}