CVE-2026-106155

Summary

A stored cross-site scripting vulnerability in the shared reporting engine of Progress® Telerik® Report Server prior to version 12.2.26.1007 allows an authenticated report author to inject malicious JavaScript, enabling privilege escalation and execution of attacker-controlled scripts in the context of the victim's session.

Exploitability

Exploitation requires an authenticated user with report author privileges and a target user who views the malicious report. The vulnerability is relatively straightforward to exploit once the attacker has crafted the malicious content.

Blast radius

If exploited, this vulnerability can lead to full control over the victim's session, potentially enabling the attacker to perform actions with higher privileges, including administrative tasks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Progress® Telerik® Report Server version 12.2.26.1007 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.