CVE-2026-106163

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filebrowser-imagebrowser-xss-cve-2026-106163	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*

History

20 Oct 2026, 19:39

Type	Values Removed	Values Added
References	~~() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filebrowser-imagebrowser-xss-cve-2026-106163 -~~	() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filebrowser-imagebrowser-xss-cve-2026-106163 - Vendor Advisory
First Time		Progress Progress kendo Ui
CPE		cpe:2.3:a:progress:kendo_ui::::::::

15 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 14:17

Updated : 2026-10-20 19:39

NVD link : CVE-2026-106163

Mitre link : CVE-2026-106163

CVE.ORG link : CVE-2026-106163

JSON object : View

Products Affected

progress

kendo_ui

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-106163", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106163", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T18:30:34.337506Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Kendo UI for jQuery", "versions": [{"status": "affected", "version": "2023.1.117", "lessThan": "2026.3.1015", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-15T14:17:15.083", "references": [{"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filebrowser-imagebrowser-xss-cve-2026-106163", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Kendo\u00ae UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application."}], "lastModified": "2026-10-20T19:39:05.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85AC0AE9-1ECF-42F8-B5C6-91255185EB17", "versionEndExcluding": "2026.3.1015", "versionStartIncluding": "2023.1.117"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}