# CVE-2026-118039: Progress Telerik Document Processing Libraries XML external entity injection in SVG

Source: https://junglewise.ai/threats/cve-2026-118039-in-progress-telerik-document-processing-libraries-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118039 · Severity: high · CVSS 7.5 · Published 2026-10-28

Progress Telerik Document Processing Libraries are used by applications to process documents and images, including PDF generation. An unauthenticated attacker can exploit an XML external entity (XXE) vulnerability in SVG image handling to read arbitrary files from the server when an application processes or exports SVG images to PDF. This allows sensitive data exfiltration from the affected server.

Technologies: [Progress Telerik Document Processing Libraries](https://junglewise.ai/threats/technologies/telerik-document-processing-libraries). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-118039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118039 being exploited in the wild.

**How severe is CVE-2026-118039?** High severity, with a CVSS score of 7.5, published 28 October 2026.

**Which products and versions are affected?** Progress Telerik Document Processing Libraries 2024.3.802 through before 2026.3.1027.

**Is there a fix for CVE-2026-118039?** Yes: fixed in 2026.3.1027. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118039 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118039?** Check whether you run Progress Telerik Document Processing Libraries at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.3.1027

## Technical details

An XML external entity reference vulnerability (CWE-611) exists in the SVG image processing component of Telerik Document Processing Libraries, affecting RadPdfProcessing (FormSource.FromSvg), RadWordsProcessing PDF export, and RadSpreadProcessing PDF export. An unauthenticated attacker can craft a malicious SVG image with nested embedded SVG elements containing XXE payloads to read local files when the application processes or exports the image. The vulnerability requires only network access with no authentication or user interaction beyond processing the crafted SVG.

## Affected products

- Progress Telerik Document Processing Libraries 2024.3.802 through before 2026.3.1027

## Timeline

- 2026-10-28: disclosed

## References

- [https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-xml-external-entity-reference-cve-2026-118039](https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-xml-external-entity-reference-cve-2026-118039)

## Related threats

- [Progress Telerik Document Processing signature validation bypass](https://junglewise.ai/threats/cve-2026-118040-in-progress-telerik-document-processing-libraries-prior-to)
- [Progress Telerik Document Processing Libraries path traversal in AI agent tools](https://junglewise.ai/threats/cve-2026-118038-in-progress-telerik-document-processing-libraries-prior-to)
- [Progress Telerik Document Processing Libraries resource consumption denial of service](https://junglewise.ai/threats/cve-2026-118036-in-progress-telerik-document-processing-libraries-prior-to)
- [Progress Telerik Document Processing Libraries denial of service in RadWordsProcessing](https://junglewise.ai/threats/cve-2026-118035-in-progress-telerik-document-processing-libraries-prior-to)