Kendo UI for jQuery CVE-2026-106163

Exploitation requires that the application deploy the Kendo UI for jQuery FileBrowser or ImageBrowser component (used with the Editor/upload workflows) on an affected version (v2023.1.117 through pre-v2026.3.1015), AND that an attacker can control the name of a file or directory that the component will enumerate and display (typically via an upload or shared-storage path). The payload only fires when a victim user actually navigates to and views the affected browser dialog, and it executes with that victim's privileges in the application's origin. Limiting factors: the attacker needs write/upload influence over the browsed storage, the victim must open the specific component, and sites not using FileBrowser/ImageBrowser are unaffected even on vulnerable versions; impact is confined to the victim's browser context (no server-side code execution).

This is a medium-severity (CVSS 6.5) DOM/stored XSS in the Kendo UI for jQuery FileBrowser and ImageBrowser components (CWE-80). No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so exploitation-probability and automatability signals are entirely absent - the assessment rests only on the CVSS vector and the vendor description. KEV status is NO and no POC is referenced, so this is not a confirmed in-the-wild threat; it reads as a credible but not urgent issue. The vendor's vector (AV:N/AC:L/PR:N/UI:N) is notably generous for what the description characterizes as script execution triggered when a user's browser renders attacker-supplied file/directory names: in practice an attacker must be able to place files or directories with script-bearing names where the component will read them (implying some upload/write capability) and a victim must actually open the FileBrowser/ImageBrowser view. CONFLICT TO VERIFY: CVSS asserts PR:N/UI:N, but the described mechanism (rendering stored names when the component is viewed) implies some attacker privilege and victim interaction - treat PR:N/UI:N as a best-case upper bound. Impact is correctly bounded to C:L/I:L/A:N (session/data exposure and limited integrity within the app context, no availability loss). Net: a real but second-tier priority - patch in normal cycles unless the FileBrowser/ImageBrowser is exposed to untrusted content, in which case prioritize.

An attacker who can influence file or directory names in a storage location served by the FileBrowser/ImageBrowser (e.g. via an upload feature or a shared directory) creates an entry whose name contains script-related HTML. When a legitimate user later opens the file/image browser, the unencoded name is rendered and the embedded JavaScript executes in their browser session, exposing or tampering with data the application can access. No public exploit code is referenced, so this would currently require attacker-developed tooling.