Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-118039

XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ProgressSoftware

Description

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Progress Software Telerik Document Processing Libraries

Default version status: unaffected

  • 2024.3.802 to < 2026.3.1027affected

References