CVE-2024-7840 is a high severity (CVSS 7.8) command injection flaw in Progress Telerik Reporting. Hyperlinks in the desktop Report Viewers and the Standalone Report Designer could carry custom commands. Progress fixed it in Telerik Reporting 2024 Q3, version 18.2.24.924. Anything older should be updated.
What's affected
The CVE-2024-7840 record says Telerik Reporting versions prior to 2024 Q3 (18.2.24.924) are affected. The Progress knowledge base article words the boundary slightly differently: it lists 2024 Q3 (18.2.24.806) or earlier as affected and tells customers to update to 2024 Q3 (18.2.24.924). Both statements point to the same fix, so 18.2.24.924 is the version to aim for.
The advisory ties the problem to the desktop tooling: the desktop Report Viewers and the Standalone Report Designer. It does not describe the web viewers as the affected surface, so read the advisory for your exact deployment before ruling anything in or out.
The record scores the issue 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms, that is a local attack that needs a user to act, with high impact on confidentiality, integrity and availability. NVD does not list it as exploited in the wild, and the record's KEV flag is false.
How to check if you're exposed
Progress documents two ways to find your Telerik Reporting version.
- If you run the Reporting REST service, request its version endpoint at
/api/reports/version/on your own host and compare the result with 18.2.24.924. - If you only use the desktop tooling, open Installed Apps in Windows settings, expand the Telerik Reporting entry and read the version.
For .NET projects, also look at what your build actually restores. The package name is Telerik.Reporting, and it normally comes from a private Telerik feed.
dotnet list package --include-transitive | grep -i telerik
Developers who ship the Standalone Report Designer to colleagues should check those machines too, since a developer laptop counts as much as a server.
What to do now
- Find every machine and project that uses Telerik Reporting, including the desktop Report Viewer and Standalone Report Designer.
- Update to Telerik Reporting 2024 Q3 (18.2.24.924) or later. Downloads need an active Telerik license, so the account owner may need to do this.
- Rebuild and redeploy applications that bundle the viewer, so the old assemblies are not left behind in installers.
- Until you have updated, be careful with report definitions and files from sources you do not control, because the flaw sits in how hyperlinks are handled.
- Record the version in your inventory so the next advisory is a lookup, not a hunt.
Why it matters
The weakness is CWE-77, improper neutralization of special elements used in a command. According to the advisory, hyperlinks in the desktop viewers and designer were allowed to contain custom commands that interact with other applications. A link in a report is data that someone else may have written, and treating it as something that can launch another program crosses a trust boundary.
Reporting components are easy to forget. They sit inside line of business apps, get licensed once and rarely appear on a patch calendar. A software inventory that includes direct and transitive dependencies shows where they are. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan if you want a quick look at a project manifest.
Quick check
Which version fixes CVE-2024-7840?
Progress lists Telerik Reporting 2024 Q3 (18.2.24.924) as the fixed version. Later releases should include the fix, but confirm against the Progress advisory.
Is CVE-2024-7840 exploited in the wild?
The record's KEV flag is false, and the advisory pages we read do not claim active exploitation.
Sources
- Progress Telerik Reporting knowledge base: Command Injection Vulnerability
- Safeguard Gold: CVE-2024-7840
Last reviewed: 19 October 2026.
