Progress Kendo UI EUVD-2026-102057

Exploitation requires the Progress Kendo UI for jQuery FileManager component specifically, and depends on the default drag hint rendering a remotely-supplied item name as HTML while the list items themselves are encoded. The concrete prerequisites are: (1) the attacker must be able to control or influence an item (file/folder) name within the FileManager; and (2) a legitimate user must actively drag that specific item, since the payload only renders in the drag hint - merely viewing the FileManager does not trigger it. These limiting factors - required user drag interaction (UI:R), high attack complexity (AC:H), and the need to seed a crafted item name - meaningfully narrow realistic exploitation and should weigh in defender prioritization despite the network attack vector.

This is a genuinely moderate, not high-priority, issue and the CVSS 4.7 (Medium) score reflects reality well. The signals are consistent rather than conflicting: the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable but high-complexity, user-interaction-dependent cross-site scripting flaw (CWE-80) with only Low confidentiality and integrity impact and no availability impact. Exploitation requires a very specific victim action - dragging a maliciously named FileManager item - which is why AC:H and UI:R are both set and why real-world exploitability is constrained. No EPSS score, CISA KEV entry, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation, so this should be treated as a routine patch-cycle item rather than an emergency. The scope change (S:C) correctly captures that injected script executes in the user's browser context, distinct from the vulnerable component, which is standard for XSS. Note that PR:N assumes the attacker can seed a malicious item name without authenticating; in many real FileManager deployments the ability to create or name items is itself gated by authentication or upload permissions, which would further reduce real-world risk - verify against the actual deployment.

An attacker arranges for a FileManager item to carry a name containing HTML with an event handler (for example by uploading or creating a file where naming is attacker-influenced). When a legitimate user browses that FileManager and drags the affected item, the unencoded name is rendered in the default drag hint and the embedded JavaScript executes in the user's browser session. No public exploit code was identified at time of analysis, and the high attack complexity plus required drag interaction make opportunistic mass exploitation unlikely.