CVE-2026-118975: XML External Entity (XXE) Injection in Telerik Reporting SVG Processing
In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network requests, from the report rendering host. External XML entities in SVG content were resolved without applying the configured strict resource resolver and report path validation. Disclosed content is limited by the permissions of the rendering process and by what the rendered report output exposes.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik Reportingto a version that resolves this vulnerability.Fixed in 20.3.26.1110
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Telerik Reporting versions earlier than 20.3.26.1110 are affected if low-privileged authenticated users can supply SVG content that is processed during report rendering.
What does an attacker need to exploit it?
An attacker needs valid low-privileged authentication and the ability to provide SVG content to a report. No user interaction is required, and exploitation occurs from the network.
What could an attacker access or cause?
An attacker may read local files or UNC files accessible to the report rendering process, or cause the rendering host to make server-side network requests. Disclosure is limited by the rendering process permissions and by the data exposed in rendered report output.
How can teams determine whether they may already be affected?
Review the deployed Telerik Reporting version and identify report workflows that accept or process user-supplied SVG content. Versions prior to 20.3.26.1110 with such workflows should be treated as potentially affected.