CVE-2026-106163: Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in v2026.3.1015
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Progress Kendo UI for jQuery FileBrowser or ImageBrowser are affected if they run a version from v2023.1.117 up to, but not including, v2026.3.1015 and render remotely supplied file or directory names.
What does an attacker need to exploit this issue?
An attacker needs to control a file or directory name that is supplied to the affected component. The malicious name must contain script-related HTML that is rendered by FileBrowser or ImageBrowser in a user's browser.
What is the likely impact if exploitation succeeds?
JavaScript can execute in the user's browser in the context of the affected application. This can compromise the confidentiality and integrity of data accessible to that application.