Telerik Document Processing CVE-2026-118039

Exploitation requires that an application using Telerik Document Processing Libraries (prior to 2026.3.1027) accept an attacker-supplied SVG image and then process it or export it to PDF through the vulnerable SVG-handling code path; the malicious SVG must contain a nested embedded SVG carrying an XML external entity reference. Although CVSS is AV:N/AC:L/PR:N/UI:N (no authentication or user interaction required), the practical limiting factor is that the host application must actually invoke SVG rendering/PDF export on untrusted input - deployments that never process external SVGs are not exposed. The flaw yields local file read only (C:H, no integrity or availability impact). The vendor advisory states that updating to version 2026.3.1027 is the fix.

This is a genuine but mid-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact (C:H) and no integrity or availability impact (I:N/A:N), consistent with a CWE-611 XML external entity file-disclosure bug - the base score of 7.5 is credible. The vuln.today decision label is 'this_week', which signals prompt but not emergency remediation. Countervailing signals temper the raw score: no EPSS probability was supplied, there is no CISA KEV listing (so no confirmed active exploitation), and no public PoC or exploit reference appears in the input - exploitation status is therefore 'no public exploit identified at time of analysis'. The practical ceiling on risk is that exploitation is not against arbitrary endpoints but only where an application built on the library actually processes or exports an attacker-supplied SVG to PDF; the 'network' vector reflects that the malicious SVG arrives remotely, not that every deployment is exposed by default. Net: treat as a real, worth-patching confidentiality issue (server-side local file read) rather than a drop-everything incident, absent EPSS/KEV evidence to the contrary.

An attacker submits a crafted SVG image containing a nested embedded SVG with an XML external entity declaration to an application that uses Telerik Document Processing Libraries to render or export that image to PDF. When the library parses the SVG, the external entity is resolved and the contents of a local server file are read and embedded into the output or otherwise disclosed to the attacker. No authentication or user interaction is required, but a public exploit was not identified in the available sources.