Cross-Site Scripting Vulnerability in Progress Kendo UI for jQuery
CVE-2026-106163

6.5MEDIUM

Key Information:

Vendor: Progress Software
Status: Kendo Ui For Jquery
Vendor: CVE Published:; 15 October 2026

🔔 Create Progress Software Vulnerability Alert

What is CVE-2026-106163?

In Progress Kendo UI for jQuery versions from v2023.1.117 to v2026.3.1014, the FileBrowser and ImageBrowser components are vulnerable due to improper encoding of file and directory names that are rendered as HTML. This flaw allows an attacker to supply malicious script-related HTML, leading to unauthorized JavaScript execution in the user's browser. Such exploitation can jeopardize the confidentiality and integrity of sensitive data within the affected web application.

Affected Version(s)

Kendo UI for jQuery 2023.1.117 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...

vendor-advisory

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 15, 2026
Vulnerability Reserved
Oct 6, 2026

Credit

komyeonghane320f9

CVE-2026-106163 Data

JSON