CVE-2026-106162: Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.3.1015
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the Kendo UI for jQuery FileManager component are exposed if they use affected versions and allow an attacker to control item names supplied to the component. Exploitation requires a user to drag the affected item.
What does an attacker need to exploit it?
The attacker must be able to set or influence a remotely supplied FileManager item name. They can then inject HTML with event handlers that runs JavaScript when a user drags that item.
Are default FileManager drag hints affected?
Yes. The issue occurs in the component's default drag hint, which renders remotely supplied item names as HTML even though the corresponding list items are encoded.
Which versions are affected and how is it fixed?
Progress Kendo UI for jQuery versions beginning with 2023.3.1010 and before 2026.3.1015 are affected. Upgrade to version 2026.3.1015 to remediate the issue.