{"id":"CVE-2026-106163","revision":"846f4cd9938f4143bf7aa188ac86f049","records":[{"revision":"846f4cd9938f4143bf7aa188ac86f049","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106163","aliases":[],"title":"Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser","description":"In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.","state":0,"publishedAt":"2026-10-15T13:18:53.367+00:00","modifiedAt":"2026-10-15T18:30:45.142+00:00","affected":[{"ecosystem":"Vendor product","name":"Kendo UI for jQuery","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progress Software\",\n                    \"product\": \"Kendo UI for jQuery\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2023.1.117\",\n                            \"lessThan\": \"2026.3.1015\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filebrowser-imagebrowser-xss-cve-2026-106163"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106163","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106163","identifiers":["CVE-2026-106163"]},"retained":false,"historicalAffected":[]}],"coverage":[]}