CVE-2026-118975

In Progress® Telerik® Reporting prior to version 20.3.26.1110 , an improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges to perform an XXE injection . By supplying malicious SVG content to a report, an attacker can...

CVE-2026-118975 XML External Entity (XXE) Injection in Telerik Reporting SVG Processing

In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network...