XSS Vulnerability in Kendo UI for jQuery FileManager Component
CVE-2026-106162

4.7MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106162?

The FileManager component of Kendo UI for jQuery versions from 2023.3.1010 up to but not including 2026.3.1015 is susceptible to an XSS vulnerability. This arises due to the component rendering user-controlled item names as HTML in its default drag hint, while the corresponding list items are properly encoded. An attacker with control over the item name can inject malicious HTML containing event handlers, which can execute JavaScript in the context of the user's browser during the drag operation. This exploitation poses risks to the confidentiality and integrity of application data. A fix has been implemented in version 2026.3.1015.

Affected Version(s)

Kendo UI for jQuery 2023.3.1010 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

komyeonghane320f9
.