CVE-2015-4670: Devexpress AJAX Control Toolkit

Medium severity, CVSS 6.4. EPSS: 1.9% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.

Affected products

• Devexpress AJAX Control Toolkit: up to and including 15.0

Published 2015-08-18. Last modified 2026-06-17.