CVE-2026-106162

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filemanager-drag-hint-xss-cve-2026-106162	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*

History

20 Oct 2026, 19:39

Type	Values Removed	Values Added
First Time		Progress Progress kendo Ui
References	~~() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filemanager-drag-hint-xss-cve-2026-106162 -~~	() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filemanager-drag-hint-xss-cve-2026-106162 - Vendor Advisory
CPE		cpe:2.3:a:progress:kendo_ui::::::::

15 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 14:17

Updated : 2026-10-20 19:39

NVD link : CVE-2026-106162

Mitre link : CVE-2026-106162

CVE.ORG link : CVE-2026-106162

JSON object : View

Products Affected

progress

kendo_ui

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-106162", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106162", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T18:30:09.270479Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Kendo UI for jQuery", "versions": [{"status": "affected", "version": "2023.3.1010", "lessThan": "2026.3.1015", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-15T14:17:14.963", "references": [{"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filemanager-drag-hint-xss-cve-2026-106162", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Kendo\u00ae UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015."}], "lastModified": "2026-10-20T19:39:14.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "682318E8-E240-4158-A789-4116ED257A74", "versionEndExcluding": "2026.3.1015", "versionStartIncluding": "2023.3.1010"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}