Description
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Progress Software Kendo UI for jQuery
Default version status: unaffected
2024.4.1112 to ≤ 2025.2.520affected
Progress Software Kendo UI for Angular
Default version status: unaffected
18.5.0 to ≤ 19.1.2affected
Progress Software KendoReact
Default version status: unaffected
5.10.0 to ≤ 11.1.0affected
Progress Software Telerik UI for ASP.NET MVC
Default version status: unaffected
2024.4.1112 to ≤ 2025.2.520affected
Progress Software Telerik UI for ASP.NET Core
Default version status: unaffected
2024.4.1112 to ≤ 2025.2.520affected
Progress Software Telerik UI for Blazor
Default version status: unaffected
3.6.0 to ≤ 9.0.0affected
References
- https://www.telerik.com/blazor-ui/documentation/knowledge-base/pdfviewer-xss-vulnerability-cve-2025-6725 ↗
- https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725 ↗
- https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725 ↗
- https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725 ↗
- https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725 ↗
- https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725 ↗