XML External Entity (XXE) Injection in Telerik Reporting SVG Processing (CVE-2026-118975)
Description
November 2026 - CVE-2026-118975
- Progress® Telerik® Reporting engine: SVG parsing and rendering, including SVG images in PictureBox items.
- Versions
>= 0and< 20.3.26.1110.
What Are the Impacts
In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper enforcement of security restrictions during SVG processing may allow an authenticated user with low privileges who can supply content to a report to access information or resources beyond the intended security boundaries of the report rendering host. Resource resolution during SVG processing was not subject to the same restrictions and validation applied elsewhere in the product. Any disclosed information is limited by the permissions of the rendering process and by what the rendered report output exposes.
Issue
- CWE-611: Improper Restriction of XML External Entity Reference
- CAPEC-201: Serialized Data External Linking
Under certain conditions, external XML entities in SVG content were resolved without applying the resource restrictions configured for the report. As a result, the report rendering host could read files or send network requests outside the intended policy.
The effective impact depends on the rendering host's file system and network permissions. The scenario applies when a user who can create or edit reports, such as a Report Server report author, or the host application, routes untrusted SVG content into a report and renders it. In embedded Telerik Reporting, exposure is determined by the host application's trust boundaries between report authors and server resources.
Solution
The issue is fixed in version 20.3.26.1110. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= 0 and < 20.3.26.1110 | >= 20.3.26.1110 |
After the update, file and network share paths referenced from SVG content are subject to the report path validation rules, unless a strict resource resolver is configured.
Recommendation: For full control over how external resources are resolved, implement the IStrictResourceResolver interface, introduced in version 20.3.26.1110, in your application and register it in the Reporting configuration. A strict resource resolver becomes the single authority for external resources referenced from SVG content, including HTTP(S) URLs, so you can explicitly allow only the locations your reports need. If your resolver denies a resource or throws an exception, the resource is not loaded.
Behavior changes:
- Without a strict resource resolver, with
ValidateReportPathsenabled (the default), absolute local file paths referenced from SVG content are denied, and UNC paths must be listed inExternalReportPaths. IfValidateReportPathsis disabled, file paths are not validated, so a strict resource resolver is the only safeguard. - Denied external resources are not loaded, and the corresponding content is not rendered.
Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® Reporting can access their downloads here: Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-118975 (Medium)
CVSS: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
In Progress® Telerik® Reporting prior to version 20.3.26.1110, insufficient enforcement of resource access restrictions during SVG processing may allow an authenticated user with low privileges who can supply content to a report to access information or resources beyond the intended security boundaries of the report rendering host. Resource access controls and validation were not consistently applied during SVG processing. The impact is limited by the permissions of the rendering process and by what the rendered report output exposes.
Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)