Skip to content
Heist/ feed
Medium

Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser

Type: advisorySource: Official CVE List1 source record

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.

Announced Source revision 1
Original source ↗

CVE-2026-106163

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106163

Kendo UI for jQuery

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Progress Software",
    "product": "Kendo UI for jQuery",
    "versions": [
      {
        "status": "affected",
        "version": "2023.1.117",
        "lessThan": "2026.3.1015",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-106163

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#30036 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement