---
id: "CVE-2026-118039"
kind: "vulnerability"
aliases: ["CVE-2026-118039"]
title: "Telerik Document Processing: XML entity flaw lets crafted SVG read server files"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["document-processing", "dotnet", "package", "pdf-export", "telerik"]
not_affected_if: ["no-svg-input", "trusted-content-only"]
published_at: "2026-10-28T13:17:06+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:34:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118039", "first_seen_at": "2026-10-28T13:33:01+00:00"}]
---

# Telerik Document Processing: XML entity flaw lets crafted SVG read server files

Telerik Document Processing Libraries before 2026.3.1027 resolve XML external entities when they process SVG images, including nested embedded SVG. An unauthenticated attacker who supplies a crafted SVG can read local files on the server when the image is processed or exported to PDF.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Telerik Document Processing Libraries version in your project's package references and confirm whether it is below `2026.3.1027`
- Find code paths that load SVG images from users or external sources and export documents to PDF

## Fix

- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118039

## From the sources

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_