CVE-2026-106163CWE-80

CVE-2026-106163

Medium · published October 15, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-10-15T18:17Z
Affected products (1)
ProductVersionsFixed in
progress/kendo_ui≥ 2023.1.117, < 2026.3.10152026.3.1015
References (1)
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filebrowser-imagebrowser-xss-cve-2026-106163 · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 13:18Z
    Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
    cvelistv5
  • 15 OCT 13:18Z
    Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
    cvelistv5