CVE-2026-106155 Details
Description
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.
A stored cross-site scripting vulnerability has been identified in Progress Telerik Report Server versions prior to 12.2.26.1007. This vulnerability resides in the shared reporting engine, where an authenticated report author can inject javascript: or vbscript: URLs into report navigation actions or HTML text box links. When the report is viewed and the embedded navigation is activated, the injected script executes in the context of the web report viewer's origin. In multi-user deployments, this vulnerability can be exploited to escalate privileges by performing actions within a higher-privilege user's authenticated session, including that of an administrator.
Users are advised to upgrade to Progress Telerik Report Server version 12.2.26.1007 or later. The update blocks javascript: and vbscript: URLs in navigation actions and HTML text box links within the shared reporting engine. Reports that previously used these URL schemes for navigation will need to be revised, as the update enforces a block across all report renderers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-improper-neutralization-of-input-cve-2026-106155 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Progress Telerik Report Server | >= 0, < 12.2.26.1007 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |