Improper XML External Entity Processing in Telerik Reporting

CVE-2026-118975

What is CVE-2026-118975?

An issue in Telerik Reporting allows an authenticated attacker with limited permissions to exploit improper restrictions in the SVG processing engine. By supplying SVG content to a report, the attacker can read local or UNC files and initiate unexpected server-side network requests. This occurs because external XML entities in SVG content are resolved without the necessary strict resource resolver and validation checks. The extent of the exposed information depends on the permissions associated with the rendering process and the data output of the rendered report.

References