Cross-Site Scripting in Kendo UI for jQuery FileBrowser and ImageBrowser (CVE-2026-106163)

Updated on Oct 14, 2026

Description

October 2026 - CVE-2026-106163

• Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.

What Are the Impacts

The FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker who can control a name returned by the application's remote data source can supply script-related HTML that executes JavaScript when the affected component renders the name in a user's browser. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The issue also affects applications that use these browsers within the Editor component.

Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version and displays attacker-controlled file or directory names in FileBrowser or ImageBrowser. This includes applications that use these browsers within the Editor component.

Issue

• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CAPEC-18: XSS Targeting Non-Script Elements

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2023.1.117 && < 2026.3.811	>= 2026.3.1015

Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following FileBrowser template override after loading the Kendo UI scripts and before initializing the affected widgets. The override uses kendo.htmlEncode to render file and directory names as text rather than HTML.

javascript

const NAMEFIELD = "name";
const SIZEFIELD = "size";
const TYPEFIELD = "type";

function sizeFormatter(value) {
	if (!value) {
		return "";
	}
	var suffix = " bytes";
	if (value >= 1073741824) {
		suffix = " GB";
		value /= 1073741824;
	} else if (value >= 1048576) {
		suffix = " MB";
		value /= 1048576;
	} else if (value >= 1024) {
		suffix = " KB";
		value /= 1024;
	}
	return Math.round(value * 100) / 100 + suffix;
}

kendo.ui.FileBrowser.fn._itemTmpl = function () {
	const result = (data) =>
		`<div class="k-listview-item" ${kendo.attr("uid")}="${data.uid}" ${kendo.attr("type")}="${data[TYPEFIELD]}">` +
		`${
			data[TYPEFIELD] === "d"
				? '<div class="k-file-preview">' +
					kendo.ui.icon({
						icon: "folder",
						iconClass: "k-file-icon",
						size: "xxxlarge",
					}) +
					"</div>"
				: '<div class="k-file-preview">' +
					kendo.ui.icon({
						icon: "file",
						iconClass: "k-file-icon",
						size: "xxxlarge",
					}) +
					"</div>"
		}` +
		`<span class="k-file-name">${kendo.htmlEncode(data[NAMEFIELD])}</span>` +
		`${data[TYPEFIELD] === "f" ? `<span class="k-file-size">${sizeFormatter(data[SIZEFIELD])}</span>` : ""}` +
		`</div>`;
	return kendo.template(result);
};

This workaround changes only the internal FileBrowser _itemTmpl method. Verify compatibility with your installed version. It does not mitigate ImageBrowser, which defines its own template, including when used within Editor. Disable the affected ImageBrowser functionality until you can upgrade or apply a separately verified ImageBrowser mitigation. Custom templates must also HTML-encode file and directory names. If another vulnerable rendering path cannot be mitigated, disable that browser functionality until the application can be upgraded.

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank komyeonghane320f9 for their responsible disclosure and cooperation.

External References

CVE-2026-106163 (Medium)

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5)

In Progress® Kendo® UI for jQuery versions starting with 2023.1.117 and prior to 2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

Finder Credit: komyeonghane320f9