Skip to content
Heist/ feed
High

Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers

Type: advisorySource: Official CVE List1 source record

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.

Announced Source revision 1
Original source ↗

CVE-2026-106155

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106155

Telerik Report Server

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Progress Software",
    "product": "Telerik Report Server",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "12.2.26.1007",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-106155

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#16429 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement