Is CVE-2026-118975 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118975 being exploited in the wild.

How severe is CVE-2026-118975?

Medium severity, with a CVSS score of 6.5, published 12 November 2026.

Which products and versions are affected?

Progress Telerik Reporting prior to 20.3.26.1110.

How is CVE-2026-118975 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118975?

Check whether you run Progress Telerik Reporting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118975: Progress Telerik Reporting XML external entity injection in SVG processing

CVE-2026-118975 · Severity: medium · CVSS 6.5 · Published 2026-11-12

Progress Telerik Reporting is a reporting and business intelligence platform used to generate and embed reports in applications. An authenticated user with low privileges can exploit improper XML entity handling in SVG images within reports to read files from the server, access network resources, or trigger network requests beyond their intended permissions. The vulnerability is limited by the file system and network permissions of the rendering process.

Vendors: Progress.

Quick answers

Is CVE-2026-118975 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118975 being exploited in the wild.
How severe is CVE-2026-118975?: Medium severity, with a CVSS score of 6.5, published 12 November 2026.
Which products and versions are affected?: Progress Telerik Reporting prior to 20.3.26.1110.
Is there a fix for CVE-2026-118975?: Yes: fixed in 20.3.26.1110. Until then: Implement the IStrictResourceResolver interface introduced in version 20.3.26.1110 to explicitly control how external resources from SVG content are resolved and to deny unauthorized locations. Ensure ValidateReportPaths is enabled (default) and list any necessary UNC paths in ExternalReportPaths. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118975 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118975?: Check whether you run Progress Telerik Reporting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 20.3.26.1110

Implement the IStrictResourceResolver interface introduced in version 20.3.26.1110 to explicitly control how external resources from SVG content are resolved and to deny unauthorized locations. Ensure ValidateReportPaths is enabled (default) and list any necessary UNC paths in ExternalReportPaths.

Technical details

The vulnerability is an XML external entity (XXE) injection in Telerik Reporting's SVG parsing engine (CWE-611). External XML entities in SVG content were resolved without applying the configured strict resource resolver and report path validation rules. An authenticated attacker with low privileges who can supply SVG content to a report can read local or UNC files or trigger server-side network requests from the rendering host, limited by the process permissions and what the report output exposes.

Affected products

Progress Telerik Reporting prior to 20.3.26.1110

Timeline

2026-11-12: disclosed

References

https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-improper-restriction-of-xml-external-entity-reference-cve-2026-118975

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.