Vulnerability · Published Oct 15, 2026 · Assigned by ProgressSoftware

CVE-2026-106163Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser

Medium 6.5

In plain English

A medium-severity security flaw in Kendo UI for jQuery from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 92.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Kendo UI for jQuery	2023.1.117 – before 2026.3.1015

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filebrowser-imagebrowser-xss-cve-2026-106163 vendor-advisory