XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing (CVE-2026-118039)

Updated on Oct 27, 2026

Description

October 2026 - CVE-2026-118039

• Progress® Telerik® Document Processing Libraries SVG image processing used by RadPdfProcessing (FormSource.FromSvg) and by PDF export in RadWordsProcessing and RadSpreadProcessing, versions >= 2024.3.802 and < 2026.3.1027.

What Are the Impacts

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.

Issue

• CWE-611: Improper Restriction of XML External Entity Reference
• CAPEC-201: Serialized Data External Linking

Solution

The issue is fixed in version 2026.3.1027. The Progress Telerik team strongly recommends upgrading to this version or later.

Current Version	Update to
>= 2024.3.802 and < 2026.3.1027	>= 2026.3.1027

All customers who have a license for Progress® Telerik® Document Processing Libraries can access their downloads here: Product Downloads | Your Account.

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.

External References

CVE-2026-118039 (High)

CVSS: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.