CVE-2026-118039: XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-28
Weakness: CWE-611

Description

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.

Affected products

Progress Software Telerik Document Processing Libraries: from 2024.3.802 before 2026.3.1027 — fixed in 2026.3.1027

How to fix

Upgrade to a fixed version: Progress Software Telerik Document Processing Libraries 2026.3.1027. Check the vendor advisory for mitigations.

References

https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-xml-external-entity-reference-cve-2026-118039

Get alerted when CVE-2026-118039 or the next vulnerability affects your stack