Cross-site Scripting Vulnerability (CVE-2026-104656)

Description

November 2026 - CVE-2026-104656

• Progress® Telerik® Fiddler® Everywhere 8.3.0 and earlier.

What Are the Impacts

In Progress Telerik Fiddler Everywhere 8.3.0 and earlier, improper neutralization of input in the sessions grid can allow an attacker to execute backend IPC commands. The attacker must convince a user to open a specially crafted session archive (SAZ) file containing a cross-site scripting payload in a session URL. The reported proof of concept used a backend command to append a text log entry to an arbitrary file.

Issue

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Solution

The issue is addressed in Progress Telerik Fiddler Everywhere 8.4.0. The application sanitizes input from untrusted session data. Where possible, file operations originating in the Angular renderer omit the file path and retrieve it from the backend instead.

Follow the Fiddler Everywhere update instructions for precise instructions. Customers can access product downloads from Product Downloads | Your Account.

Mitigation

Do not open SAZ files from untrusted sources.

Notes

• Progress Software thanks maxsongce8805 for responsibly disclosing this vulnerability.
• If you have questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.

External References

• CVE-2026-104656 (Medium)

CVSS: 6.5 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L)

In Progress Telerik Fiddler Everywhere 8.3.0 and earlier, improper neutralization of input in the sessions grid allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.