Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery (CVE-2026-106162)

Updated on Oct 14, 2026

Description

October 2026 - CVE-2026-106162

• Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.

What Are the Impacts

The FileManager encodes remotely supplied item names in its list items but renders the same values as HTML in its default drag hint. An attacker who can control an item name can introduce HTML containing event handlers. JavaScript can execute in a user's browser when the user drags the affected item, compromising the confidentiality and integrity of data accessible to the affected application. Encoding list-item names does not protect the separate drag-hint rendering path.

Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version, allows FileManager drag-and-drop, and displays attacker-controlled item names in the default drag hint. Encoding the names in list items alone does not protect the drag hint.

Issue

• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CAPEC-18: XSS Targeting Non-Script Elements

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2023.3.1010 && <= 2026.3.811	>= 2026.3.1015

Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, restrict item-name metadata to trusted sources or disable FileManager drag-and-drop through the supported configuration for your version.

The following temporary override HTML-encodes item names and the multi-item label in drag hints. Apply it after loading the Kendo UI FileManager scripts and before initializing the affected widgets.

Warning: _hint is a private method with internal drag-and-drop side effects. Replacing it may interfere with moving files. Use this override only to verify or temporarily prevent HTML injection in the hint, and test file moves and both single-item and multi-item dragging before deploying it. Upgrading is the preferred solution.

javascript

 var originalFileManagerHint = kendo.ui.filemanager.ViewComponent.fn._hint;
kendo.ui.filemanager.ViewComponent.fn._hint = function(target) {
	originalFileManagerHint.call(this, target);
	var that = this,
		item = that.widgetComponent.dataItem(target),
		selectedItems = that.widgetComponent.select();
	if (selectedItems.length > 1) {
		return `<div class="k-filemanager-drag-hint">` +
			`${kendo.ui.icon("file")} ` +
			`<span>${selectedItems.length} ${kendo.htmlEncode(that.options.messages.items)}</span>` +
		`</div>`;
	}
	return `<div class="k-filemanager-drag-hint">` +
		`${kendo.ui.icon(item.isDirectory ? "folder" : "file")} ` +
		`<span>${kendo.htmlEncode(item.name)}</span>` +
	`</div>`;
};

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank komyeonghane320f9 for their responsible disclosure and cooperation.

External References

CVE-2026-106162 (Medium)

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7)

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.811, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

Finder Credit: komyeonghane320f9