Is CVE-2026-106163 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106163 being exploited in the wild.

How severe is CVE-2026-106163?

Medium severity, with a CVSS score of 6.5, published 15 October 2026.

Which products and versions are affected?

Progress Kendo UI for jQuery v2023.1.117 through v2026.3.811.

How is CVE-2026-106163 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106163?

Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106163: Progress Kendo UI for jQuery cross-site scripting in FileBrowser and ImageBrowser

CVE-2026-106163 · Severity: medium · CVSS 6.5 · Published 2026-10-15

Progress Kendo UI for jQuery is a web component library used to build interactive data-driven web applications. The FileBrowser and ImageBrowser components fail to properly encode file and directory names supplied from a remote data source, allowing an attacker to inject malicious JavaScript that executes in users' browsers. Successful exploitation can compromise user data confidentiality and integrity, as well as allow session hijacking or account takeover.

Technologies: Progress Kendo UI for jQuery. Vendors: Progress.

Quick answers

Is CVE-2026-106163 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106163 being exploited in the wild.
How severe is CVE-2026-106163?: Medium severity, with a CVSS score of 6.5, published 15 October 2026.
Which products and versions are affected?: Progress Kendo UI for jQuery v2023.1.117 through v2026.3.811.
Is there a fix for CVE-2026-106163?: Yes: fixed in v2026.3.1015. Until then: If immediate upgrade is not possible, apply a FileBrowser template override using kendo.htmlEncode to render file and directory names as text. Disable ImageBrowser functionality until upgrade or a separately verified ImageBrowser mitigation is applied. Custom templates must also HTML-encode file and directory names. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106163 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106163?: Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: v2026.3.1015

If immediate upgrade is not possible, apply a FileBrowser template override using kendo.htmlEncode to render file and directory names as text. Disable ImageBrowser functionality until upgrade or a separately verified ImageBrowser mitigation is applied. Custom templates must also HTML-encode file and directory names.

Technical details

The vulnerability is an improper neutralization of script-related HTML tags (CWE-80) in the FileBrowser and ImageBrowser components. These components render remotely supplied file and directory names directly as HTML without encoding, enabling XSS via attacker-controlled file/directory names. The vulnerability requires the application to display attacker-controlled data from a remote source and affects users viewing such content, with no authentication or special privileges needed.

Affected products

Progress Kendo UI for jQuery v2023.1.117 through v2026.3.811

Timeline

2026-10-15: disclosed: CVE-2026-106163 published

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-filebrowser-imagebrowser-xss-cve-2026-106163

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.