CVE-2026-118039: XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing

Published Oct 28, 2026

Updated

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress Telerik Document Processing Libraries to a version that resolves this vulnerability.
Fixed in 2026.3.1027

Event History

Oct 28, 2026

CVE Published

via MITRE·12:29 PM

Data Sourced

via MITRE·12:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which releases are affected?

Progress Telerik Document Processing Libraries releases earlier than 2026.3.1027 are affected.

What must happen for exploitation to occur?

An unauthenticated attacker must provide a crafted SVG containing a nested embedded SVG. The malicious image must then be processed or exported to PDF by the server.

What could an attacker obtain?

Successful exploitation can allow the attacker to read local files on the server.

CVE-2026-118039: XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing

Remediation

Event History

Frequently Asked Questions

Which releases are affected?

What must happen for exploitation to occur?

What could an attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Which releases are affected?

What must happen for exploitation to occur?

What could an attacker obtain?