CVE-2026-118039: falha de alta gravidade em Progress Software Telerik Document Processing…
XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.3%
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Progress Software · Telerik Document Processing LibrariesCVEs relacionadas — Progress Software Telerik Document Processing…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11343HIGHTelerik Document Processing Path TraversalEPSS 0.7%CVE-2024-8049MEDIUMTelerik Document Processing Improper Handling of Memory ResourcesEPSS 0.4%CVE-2026-118036HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question AnsweringEPSS 0.4%CVE-2026-118035HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessingEPSS 0.3%CVE-2026-118037HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessingEPSS 0.3%CVE-2026-118038HIGHPath Traversal in Telerik Document Processing Libraries AI Agent ToolsEPSS 0.3%