CVE-2017-11317

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2...

9.8 CriticalIn KEVPublic exploit

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

84.2%Up 39.1 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2017-11317
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-326
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2017-11317
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-326
Updated: 2026-11-02

EUVDEUVD-2017-2951 9.8

Record: EUVD-2017-2951
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9v96-j7x8-6wjv 9.8

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2...

Record: GHSA-9v96-j7x8-6wjv
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-326
Updated: 2026-11-02

CISA KEV No score

Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Record: CVE-2017-11317
Weakness: CWE-326
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	bao7uo/RAU_crypto	2018-01-09
Exploit-DB	Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Arbitrary File Upload	2018-01-24
Metasploit	Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization	2019-12-09
PoC in GitHub	KasunPriyashan/Telerik-UI-ASP.NET-AJAX-Exploitation	2022-10-13
PoC in GitHub	0xr2r/CVE-2017-11317-auto-exploit-	2025-08-15

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-11317 is a critical vulnerability (CVSS 9.8) in Telerik Ui For Asp.net Ajax, published August 23, 2017. CISA lists it as known to be exploited, since April 11, 2022. EUVD reports exploitation since April 11, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 84.2%, the 99th percentile. No source names a fixed version.