The vulnerability arises when the FileBrowser and ImageBrowser components of Kendo UI for jQuery render file and directory names supplied from the server as raw HTML. Because the names are not properly encoded, an attacker can craft a name that includes script tags or other HTML that is interpreted by the browser and executed in the context of the application. This results in a classic reflected XSS that can compromise the confidentiality and integrity of data viewed by the user.

Affected systems are Progress Software’s Kendo UI for jQuery, specifically the FileBrowser and ImageBrowser widgets. Versions v2023.1.117 up to, but not including, v2026.3.1015 are vulnerable. The patch is available in later releases; upgrading beyond v2026.3.1015 removes the flaw.

The CVSS base score of 6.5 indicates a medium severity, but the EPSS of less than 1% suggests that real‑world exploitation is unlikely at present. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description, as it is not explicitly stated: an attacker can trigger the XSS by placing a malicious file or directory name on the server or by persuading an authenticated user to access a page that lists such a name. The issue requires the target application to be loaded in a browser and no privileged access is needed beyond the ability to influence file names.