CVE-2026-118975
XML External Entity (XXE) Injection in Telerik Reporting SVG Processing
In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network requests, from the report rendering host. External XML entities in SVG content were resolved without applying the configured strict resource resolver and report path validation. Disclosed content is limited by the permissions of the rendering process and by what the rendered report output exposes.
| CWE | CWE-611 |
| Vendor | progress software |
| Product | telerik reporting |
| Published | Nov 12, 2026 |
Get instant alerts for progress software telerik reporting
Be the first to know when new medium vulnerabilities affecting progress software telerik reporting are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N