The vulnerability is a classic XML External Entity (XXE) flaw involving SVG image processing in Progress Telerik Document Processing Libraries. An attacker who can supply a crafted SVG file with a nested embedded SVG can exploit this flaw to read arbitrary files from the server’s file system when the library processes or exports the image to PDF. The impact is the non‑disclosure of local files, which can lead to confidentiality leakage and further compromise if the files contain credentials or configuration data. The weakness is identified as CWE‑611, implying improper handling of XML input streams.

The affected product is Progress Software Telerik Document Processing Libraries, versions prior to 2026.3.1027. Because no specific version range is listed beyond the latest patch, all releases before this version are considered vulnerable. No other vendor or product is mentioned.

The CVSS score of 7.5 reflects a moderate to high severity vulnerability that can be abused without authentication. The EPSS score is unavailable, but the lack of a KEV listing suggests no publicly known active exploitation at the time of reporting. The likely attack vector is the delivery of a malicious SVG file to the application, which the library processes automatically when rendering or converting images. If the library is invoked by a public endpoint or processes user‐supplied files, the risk of exploitation is high.