Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118975— XML External Entity (XXE) Injection in Telerik Reporting SVG Processing

Quick assessment

Affected
Progress Software Telerik Reporting
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 20.3.26.1110 之前的 In Progress® Telerik® Reporting 中，SVG 处理引擎对 XML 外部实体（XXE）引用的限制不当，导致拥有低权限但已认证的攻击者，若能够向报表提供 SVG 内容，即可从报表渲染主机读取本地文件或 UNC 路径文件，或触发服务器端网络请求。SVG 内容中的外部 XML 实体在解析时未应用已配置的严格资源解析器及报表路径验证机制。可泄露的内容范围受限于渲染进程的权限，以及最终渲染报表输出所暴露的信息。

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118975

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
XML External Entity (XXE) Injection in Telerik Reporting SVG Processing
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network requests, from the report rendering host. External XML entities in SVG content were resolved without applying the configured strict resource resolver and report path validation. Disclosed content is limited by the permissions of the rendering process and by what the rendered report output exposes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progress Software Telerik Reporting 0 ~ 20.3.26.1110 -

II. Public POCs for CVE-2026-118975

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118975

请登录查看更多情报信息。

Other References for CVE-2026-118975 (1)

Same Patch Batch · Progress Software · 2026-11-12 · 7 CVEs total

CVE-2026-124699 7.8 HIGH Improper Control of Generation of Code in Progress Telerik UI for WinForms
CVE-2026-124701 7.8 HIGH Deserialization of Untrusted Data in Progress Telerik UI for WinForms
CVE-2026-124704 7.8 HIGH Deserialization of Untrusted Data in Progress Telerik UI for WPF
CVE-2026-124703 7.8 HIGH Improper Control of Generation of Code in Progress Telerik UI for WPF
CVE-2026-124705 7.8 HIGH URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI
CVE-2026-106140 7.3 HIGH Deserialization of Untrusted Data in Telerik Reporting Report Designers

IV. Related Vulnerabilities

Same product: Telerik Reporting
Same vendor: Progress Software
Same weakness: CWE-611