CVE-2026-106155 in Telerik Report Server
Summary
by MITRE • 10/09/2026
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Progress Telerik Report Server versions prior to 12.2.26.1007 represents a significant security flaw within the shared reporting engine, specifically categorized as a stored cross-site scripting (XSS) issue. This type of vulnerability arises when an application stores untrusted data without proper validation or encoding and subsequently renders that data in a web page context where it is interpreted as executable code rather than safe text. In this specific instance, the flaw allows authenticated report authors to inject malicious scripts by embedding javascript: or vbscript: URLs directly into report navigation actions or HTML text box links within their reports. Because these inputs are stored server-side and served to other users upon request, the attack does not require complex social engineering beyond convincing a user with author privileges to create a compromised report, making it particularly dangerous in enterprise environments where content creation is distributed among many users.
The operational impact of this vulnerability extends far beyond simple script execution within the victim's browser context. When another user views the maliciously crafted report and triggers the embedded navigation action, the attacker-controlled script executes with the privileges of that viewing user. In a multi-user deployment scenario, this mechanism facilitates privilege escalation attacks. An attacker who has compromised an account with lower-level reporting permissions can craft a report containing these malicious payloads. Upon execution by a higher-privilege user or even an administrator, the injected scripts run in the context of the victim's authenticated session. This allows the attacker to perform actions on behalf of the privileged user, such as modifying system configurations, accessing sensitive data, creating new administrative accounts, or exfiltrating confidential information stored within the reporting platform. The use of javascript: and vbscript: URIs specifically targets legacy browser behaviors and specific rendering engines that may interpret these protocol handlers as executable code rather than literal strings, bypassing standard input validation checks if they are not explicitly configured to reject such patterns.
From a standards perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The stored nature of the attack corresponds to persistent XSS vectors where the malicious payload is saved on the target server and retrieved later by victims. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability supports techniques related to Client-side Execution such as Command and Scripting Interpreter or Browser-based Credential Access if used for session hijacking. The ability to escalate privileges through stored XSS highlights a critical failure in input validation and output encoding mechanisms within the report generation engine, violating fundamental principles of secure web application design that mandate strict sanitization of all user-supplied data before storage and rendering.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to upgrade the Progress Telerik Report Server software to version 12.2.26.1007 or later, where this specific flaw has been addressed by developers through enhanced input validation and output encoding routines that neutralize dangerous protocol handlers like javascript: and vbscript:. For organizations unable to patch immediately due to operational constraints, implementing a Web Application Firewall can provide an additional layer of defense by inspecting incoming requests for patterns indicative of XSS attacks and blocking those containing malicious script injections. Additionally, administrators should enforce strict Content Security Policy headers that restrict the execution of inline scripts and limit allowed sources for executable content, thereby mitigating the impact even if a payload is successfully injected into stored reports. Regular security audits focusing on input validation logic in report authoring tools are also recommended to ensure that all user-controlled fields undergo rigorous sanitization before being persisted to the database or rendered in client-side views.