{"id":"CVE-2026-118039","kind":"vulnerability","aliases":["CVE-2026-118039"],"related":[],"title":"Telerik Document Processing: XML entity flaw lets crafted SVG read server files","description":"In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.","summary":"Telerik Document Processing Libraries before 2026.3.1027 resolve XML external entities when they process SVG images, including nested embedded SVG. An unauthenticated attacker who supplies a crafted SVG can read local files on the server when the image is processed or exported to PDF.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-processing","dotnet","package","pdf-export","telerik"],"not_affected_if":["no-svg-input","trusted-content-only"],"how_to_check":"- Check the installed Telerik Document Processing Libraries version in your project's package references and confirm whether it is below `2026.3.1027`\n- Find code paths that load SVG images from users or external sources and export documents to PDF","fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later","status":"open","published_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:03+00:00","updated_at":"2026-10-28T13:34:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T13:34:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later","reach":"internet","title":"Telerik Document Processing: XML entity flaw lets crafted SVG read server files","impact":"medium","summary":"Telerik Document Processing Libraries before 2026.3.1027 resolve XML external entities when they process SVG images, including nested embedded SVG. An unauthenticated attacker who supplies a crafted SVG can read local files on the server when the image is processed or exported to PDF.","category":"package","nicknames":[],"who_cares":["dotnet","telerik","document-processing","pdf-export"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads arbitrary local files on the server.","analyst_note":"Confirm the affected product list and exact version range at the vendor advisory; NVD text is the only source here.","how_to_check":"- Check the installed Telerik Document Processing Libraries version in your project's package references and confirm whether it is below `2026.3.1027`\n- Find code paths that load SVG images from users or external sources and export documents to PDF","needs_analyst":true,"not_affected_if":["no-svg-input","trusted-content-only"],"who_is_affected":"Applications that use Telerik Document Processing Libraries to process or export SVG images supplied by users or other untrusted sources are exposed. Applications that never handle SVG input, or that only process trusted content, are less exposed. The sources do not say which SVG features or export settings are required beyond the processing and PDF export path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000615,"input_tokens":3325,"output_tokens":565,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118039':15A,18A '-2026':14A,17A '2026.3.1027':33B,80C 'allow':91C 'attack':49B,94C 'craft':8A,53B,104C 'cve':13A,16A 'document':2A,20B,29B,74C 'document-process':19B 'dotnet':22B 'embed':45B,110C 'entiti':5A,37B,84C 'export':26B,68B,118C 'extern':36B,83C 'file':12A,58B,98C 'flaw':6A 'imag':42B,64B,89C,106C,114C 'includ':43B 'let':7A 'librari':31B,76C 'local':57B,97C 'nest':44B,109C 'packag':23B 'pdf':25B,70B,120C 'pdf-export':24B 'prior':77C 'process':3A,21B,30B,40B,66B,75C,90C,116C 'progress':72C 'read':10A,56B,96C 'refer':85C 'resolv':34B 'server':11A,61B,101C 'suppli':51B 'svg':9A,41B,46B,54B,88C,105C,111C 'telerik':1A,27B,28B,73C 'unauthent':48B,93C 'version':79C 'via':102C 'vulner':86C 'xml':4A,35B,82C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Telerik Document Processing Libraries to process or export SVG images supplied by users or other untrusted sources are exposed. Applications that never handle SVG input, or that only process trusted content, are less exposed. The sources do not say which SVG features or export settings are required beyond the processing and PDF export path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118039","severity":null,"published_at":"2026-10-28T13:17:06+00:00","modified_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}