CVE-2025-0332: High Path Traversal in Telerik UI for WinForms

CVE-2025-0332 is a high severity (7.8) path traversal flaw in Progress Telerik UI for WinForms. Versions before 2025 Q1 (2025.1.211) can decompress an archive's contents into a restricted directory. Progress fixed it in 2025 Q1, so update the Telerik packages and rebuild any application that ships them.

What's affected

Progress lists Telerik UI for WinForms 2024 Q4 (2024.4.1113) or earlier as affected. The guidance in its knowledge base article is to update to 2025 Q1 (2025.1.211). The vendor page says licensed customers can download the release from their account.

The weakness is CWE-22, improper limitation of a pathname to a restricted directory. In plain terms, when the library unpacks an archive it does not keep every extracted file inside the folder it was meant to write to.

The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Read that as a local attack that needs no privileges, but does need a user to take an action, such as opening or processing a crafted archive. Impact is rated high for confidentiality, integrity and availability. The record does not say the flaw is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.

This is a UI component library, so the exposure sits in your applications, not on a server you patch. Each desktop app that bundles an affected Telerik assembly carries the flaw until you rebuild and redeploy it.

How to check if you're exposed

Progress gives two ways to read the version. In source code, inspect the version of any Telerik.WinControls assembly your project references. In a deployed app, find a Telerik.WinControls DLL in the application folder, open its Properties, and read the version on the Details tab.

On Windows you can read the same value from PowerShell:

Get-ChildItem -Recurse -Filter "Telerik.WinControls*.dll" | Select-Object FullName, @{n='Version';e={$_.VersionInfo.FileVersion}}

Any version at or below 2024.4.1113 is in scope. If your project pulls the packages through NuGet, you can also list them from the project folder:

dotnet list package

Look for Telerik entries in the output and compare their versions with 2025.1.211. Telerik packages often come from a private feed, so your package source may differ from public NuGet.

Also look at what your app does with archives. If it never extracts a zip or similar file that a user or another system supplies, the practical risk is lower, but you should still update because the library is the one place to fix it.

What to do now

1. List every WinForms application you build or buy that uses Telerik controls, including internal tools.
2. Update the Telerik UI for WinForms references to 2025 Q1 (2025.1.211) or later, following the update instructions Progress links from its article.
3. Rebuild, test and redeploy each application. Updating the package on a build machine does not change apps already installed on desktops.
4. Until then, avoid opening archives from untrusted sources in the affected apps.
5. Add the Telerik version to your dependency inventory so the next advisory is a lookup, not a search.
6. Rescan your repositories with the free Gold dependency scan after the change.

Why it matters

Path traversal during archive extraction is a long-running pattern, sometimes called zip slip. Archive entries carry their own file names. If the extractor trusts those names, an entry can point outside the target folder and overwrite a file elsewhere on disk. The safe approach is to resolve each destination path and confirm it is still inside the intended directory before writing.

Because the flaw lives in a shared component, one library fix covers many apps, but only after each app is rebuilt. That is why an inventory of what you ship matters more than the patch itself.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD record for CVE-2025-0332
• Gold vulnerability page
• Progress Telerik knowledge base article

Last reviewed: 19 October 2026.