Telerik Report Server: Stored cross-site scripting in web report viewers
Summary
Telerik Report Server versions before 12.2.26.1007 contain a stored cross-site scripting flaw in the shared reporting engine and web report viewers. An authenticated report author can embed javascript: or vbscript: URLs in navigation actions or HTML text box links. When another user opens the report and triggers the link, attacker-controlled script runs in the viewer's origin. In multi-user deployments, this can be used to perform actions in an administrator's session and escalate privileges.
Affected
- Telerik Report Server versions prior to 12.2.26.1007
Fixed in
- Version 12.2.26.1007 or later (vendor fix; confirm the exact build in the vendor knowledge base)
Workaround
Unknown. No vendor-documented workaround was found; the vendor recommends upgrading.
Exploitation
- No public proof of concept found for this CVE.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- EPSS 0.00199 (low).
- Exploitation in the wild: not confirmed (one unverified third-party tag).
Our recommendation
- Upgrade to version 12.2.26.1007 or later as soon as possible.
- Until patched, review who can author or edit reports and review existing reports for javascript: or vbscript: links.
- Restrict administrator accounts to dedicated admin sessions where possible.
- Patch CVE-2026-106145 (same fixed version) at the same time.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik KB: Stored Cross-site Scripting in Telerik Report Server Web Report Viewers (CVE-2026-106155) www.telerik.com
- Strix: CVE-2026-106155 www.strix.ai
- VulDB: CVE-2026-106155 vuldb.com
- Vulners: RAPID7 CVE-2026-106155 (EPSS) vulners.com
- ComponentSource: Telerik Report Server releases www.componentsource.com
- Telerik report-server-docs pull request 326 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:34.
Original description (NVD)
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.