Is CVE-2020-11414 actively exploited?

No active exploitation of CVE-2020-11414 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-11414 be exploited remotely?

Yes. CVE-2020-11414 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-11414?

CVE-2020-11414 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2020-11414

HIGH

CVE-2020-11414

CWE-22Published: March 31, 2020· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the directory where the upload handler class is defined. Before 2020.1.330, a crafted web request could result in uploads to arbitrary locations.

NVD Source

Technical Analysis

CVE-2020-11414 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.