CVE-2026-106162
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Progress Kendo UI for jQuery FileManager

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106162
EUVD
EUVD-2026-102057

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2023.3.1010

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Progress Kendo UI for jQuery's FileManager component. It occurs because item names supplied by an attacker are rendered as HTML in drag hints without proper encoding. When a user drags an affected item, the injected JavaScript executes in their browser, potentially compromising data confidentiality and integrity.

Detection Guidance

Check the version of Kendo UI for jQuery in use. If it is between 2023.3.1010 and prior to 2026.3.1015, the system is vulnerable. Inspect FileManager component drag hints for HTML injection in item names.

Impact Analysis

An attacker could steal sensitive data, modify displayed content, or perform actions on your behalf within the affected application. Users interacting with the FileManager component may unknowingly trigger malicious scripts, leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines, legal penalties, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Upgrade Kendo UI for jQuery to version 2026.3.1015 or later to address the vulnerability. If immediate upgrade is not possible, review and sanitize all item names used in the FileManager component to prevent HTML injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart