All vulnerabilities
CVE-2026-118039

XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing

Progress Software Telerik Document Processing Libraries
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2026.3.1027Fixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 2026.3.1027Telerik Document Processing LibrariesCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.

Text from CVE List

Affected versions 1

  • Telerik Document Processing Librariesaffected: 2024.3.802 before 2026.3.1027CVE List

References 1