Live › vulnerability › CVE-2026-118039
Go to dashboardTelerik Document Processing Libraries before 2026.3.1027 resolve XML external entities when they process SVG images, including nested embedded SVG. An unauthenticated attacker who supplies a crafted SVG can read local files on the server when the image is processed or exported to PDF.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Applications that use Telerik Document Processing Libraries to process or export SVG images supplied by users or other untrusted sources are exposed. Applications that never handle SVG input, or that only process trusted content, are less exposed. The sources do not say which SVG features or export settings are required beyond the processing and PDF export path.
No product ranges from the sources yet.
2026.3.10272026.3.1027 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.
This page as .md · .json · in your agent: get_signal("CVE-2026-118039")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.