CVE-2026-118039 in Telerik Document Processing Libraries
Summary
by MITRE • 10/28/2026
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within the Progress Telerik Document Processing Libraries, specifically affecting versions prior to 2026.3.1027. This vulnerability stems from an improper neutralization of special elements used in XML processing during the handling of Scalable Vector Graphics images. The core technical issue is classified as CWE-611, which denotes Improper Restriction of XML External Entity Reference. In this context, the library fails to adequately sanitize or restrict external entity definitions when parsing SVG content that contains nested embedded SVG structures. This lack of input validation allows an attacker to inject malicious XML entities into the processing pipeline. When a crafted SVG image containing these nested elements is processed by the application, particularly during operations such as exporting the document to PDF format, the underlying parser interprets the external entity references rather than treating them as static data.
The operational impact of this vulnerability is significant because it enables an unauthenticated attacker to perform server-side request forgery-like actions that result in local file disclosure. By crafting a specific SVG payload with nested entities pointing to local system paths, such as /etc/passwd on Linux systems or C:\Windows\System32\drivers\etc\hosts on Windows environments, the attacker can force the application's XML parser to read these files and include their contents within the processed output. This mechanism effectively bypasses standard access controls because the vulnerability exploits the server-side processing capabilities rather than client-side execution. The ability to read arbitrary local files can lead to a severe compromise of confidentiality, potentially exposing sensitive configuration data, source code credentials, database connection strings, or other critical internal information that should remain isolated from external users.
This attack vector aligns with MITRE ATT&CK technique T1083, which covers File and Directory Discovery, as well as aspects of T1552, Unsecured Credentials, if the disclosed files contain sensitive authentication material. The vulnerability is particularly dangerous in web applications that utilize these libraries for dynamic document generation or image processing services exposed to untrusted input sources. Since the attack requires no prior authentication, it lowers the barrier for exploitation significantly, allowing any remote actor with network access to attempt this exploit. The nested nature of the SVG embedding suggests a sophisticated parsing logic flaw where inner entities are not properly isolated from outer context restrictions, leading to unintended entity expansion that accesses local resources.
To mitigate this vulnerability, organizations must immediately upgrade their Progress Telerik Document Processing Libraries to version 2026.3.1027 or later, which includes the necessary patches for input validation and external entity restriction. In scenarios where an immediate update is not feasible, defensive measures should include implementing strict allow-listing of allowed SVG tags and attributes at a proxy or WAF level before they reach the application server. Additionally, configuring the XML parser to disable DTD processing and external entity resolution entirely can prevent this specific class of attacks. Security teams should also audit existing codebases for any direct usage of these libraries with untrusted user-supplied SVG inputs and implement rigorous input sanitization routines that strip or escape potentially dangerous entities before they are passed to the document processing engine.