Threats tagged 'ghsa-j84x-27xj-gxm6'

In Progress Telerik Reporting versions prior to 20.3.26.1110 contain a vulnerability in the SVG processing engine where XML external entity references are improperly restricted. This flaw allows an authenticated user with low privileges who can supply SVG content to a report to read local or UNC files or cause server-side network requests from the report rendering host. The vulnerability arises because external XML entities in SVG content are resolved without enforcing the configured strict resource resolver and report path validation. The disclosed data is limited by the rendering process permissions and the report output exposure.