Is CVE-2026-118039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118039 being exploited in the wild.

How severe is CVE-2026-118039?

High severity, with a CVSS score of 7.5, published 28 October 2026.

Which products and versions are affected?

Progress Telerik Document Processing Libraries 2024.3.802 through before 2026.3.1027.

Is there a fix for CVE-2026-118039?

Yes: fixed in 2026.3.1027. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118039 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118039?

Check whether you run Progress Telerik Document Processing Libraries at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118039: Progress Telerik Document Processing Libraries XML external entity injection in SVG

CVE-2026-118039 · Severity: high · CVSS 7.5 · Published 2026-10-28

Progress Telerik Document Processing Libraries are used by applications to process documents and images, including PDF generation. An unauthenticated attacker can exploit an XML external entity (XXE) vulnerability in SVG image handling to read arbitrary files from the server when an application processes or exports SVG images to PDF. This allows sensitive data exfiltration from the affected server.

Technologies: Progress Telerik Document Processing Libraries. Vendors: Progress.

Quick answers

Is CVE-2026-118039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118039 being exploited in the wild.
How severe is CVE-2026-118039?: High severity, with a CVSS score of 7.5, published 28 October 2026.
Which products and versions are affected?: Progress Telerik Document Processing Libraries 2024.3.802 through before 2026.3.1027.
Is there a fix for CVE-2026-118039?: Yes: fixed in 2026.3.1027. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118039 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118039?: Check whether you run Progress Telerik Document Processing Libraries at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.3.1027

Technical details

An XML external entity reference vulnerability (CWE-611) exists in the SVG image processing component of Telerik Document Processing Libraries, affecting RadPdfProcessing (FormSource.FromSvg), RadWordsProcessing PDF export, and RadSpreadProcessing PDF export. An unauthenticated attacker can craft a malicious SVG image with nested embedded SVG elements containing XXE payloads to read local files when the application processes or exports the image. The vulnerability requires only network access with no authentication or user interaction beyond processing the crafted SVG.

Affected products

Progress Telerik Document Processing Libraries 2024.3.802 through before 2026.3.1027

Timeline

2026-10-28: disclosed

References

https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-xml-external-entity-reference-cve-2026-118039

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.