[Release] GroupDocs.Annotation for .NET 26.10 – External Resources Skipped by Default

GroupDocs.Annotation Product Family
,
1

Dear GroupDocs users, we’re pleased to announce GroupDocs.Annotation for .NET 26.10. This is a security-focused release: documents no longer load the remote images, style sheets or linked files they reference unless you allow it, and new LoadOptions members give you full control over what is loaded. The release also upgrades the underlying document engines, updates a vulnerable dependency and fixes several issues with EML files, older documents on .NET 8 and PDF page rotation.

:lock: External resources are no longer loaded by default

A document can reference resources outside itself: an <img src="https://..."> in an HTML page or an e-mail body, a linked picture in a Word document, a remote style sheet or an external workbook link. Until now, opening, previewing or saving such a document made GroupDocs.Annotation request those resources from the network or a file share.

On a server that processes untrusted documents, this is a server-side request forgery (SSRF) risk: a document could make the server call internal addresses, and a UNC path could leak the Windows credentials of the process.

Starting with 26.10, external resources are skipped by default for Word-processing, HTML, e-mail (EML, MSG, MHT), presentation and spreadsheet documents:

  • No requests – no network or file-share request is made in any operation: Get, Add, Save, GeneratePreview and GetDocumentInfo.
  • Empty placeholders – a skipped image is rendered as a transparent placeholder; the original link is kept in the saved document.
  • Embedded content still works – cid: parts of an e-mail, data: URIs and embedded pictures are always loaded.
  • Image annotations are not affected – ImageAnnotation.ImagePath is still loaded from a URL.

Action required if your documents rely on remote images or style sheets being rendered. Allow them explicitly with the new LoadOptions members:

Member Default Description
SkipExternalResources true Set it to false to restore the pre-26.10 behaviour.
WhitelistedResources empty Host names or absolute URI prefixes loaded even when resources are skipped.
ExternalResourceHandler null Called for every external resource; it can allow it, skip it or supply its content.

Allow trusted hosts only (recommended):

LoadOptions loadOptions = new LoadOptions
{
    // SkipExternalResources stays true (the default)
    WhitelistedResources = { "cdn.example.com", "https://intranet.example.com/images/" }
};

using (Annotator annotator = new Annotator("input.html", loadOptions))
{
    annotator.Save("output.html"); // only images from the two whitelisted locations are loaded
}

Inspect, allow or substitute each resource with a handler:

class AuditingResourceHandler : ExternalResourceHandler
{
    public override void OnLoading(ExternalResourceLoadingArgs args)
    {
        Console.WriteLine($"{args.Uri}: {(args.Skipped ? "skipped" : "loaded")}");

        // serve a local copy instead of going to the network
        if (args.Uri == "https://example.com/logo.png")
            args.Data = File.ReadAllBytes("logo.png");
    }
}

(ANNOTATIONNET-2663)

:rocket: Engine upgrade and security update

  • Document engines – the bundled Word-processing, Spreadsheet, Presentation, PDF, Diagram, Email, Imaging, CAD and graphics rendering engines are updated to their October 2026 releases. Regenerated documents and previews may differ slightly at the byte or pixel level while remaining visually equivalent. On .NET 6 and .NET 8 the runtime packages now depend on SkiaSharp 4.152.1 – if your project references SkiaSharp 3.x directly, update it to 4.x. (ANNOTATIONNET-2687)
  • System.Security.Cryptography.Pkcs 8.0.2 – the engines bring in Pkcs 8.0.0/8.0.1, affected by CVE-2026-84008 and CVE-2026-70162. GroupDocs.Annotation now references the patched 8.0.2 on every target framework; no code changes are required. (ANNOTATIONNET-2672)

:wrench: Fixes

  • EML from a stream – an EML message starting with MIME-Version: 1.0 was detected as an MHT archive, and opening it from a stream threw FileTypeNotSupportedException. Such messages now open the same way from a stream and from a file, and MHT files are now supported as e-mail documents. (ANNOTATIONNET-2102)
  • Older documents on .NET 8 – documents annotated by versions before 26.6 failed to open on .NET 8 with NotSupportedException. They now open: the legacy annotations are skipped with a log warning, and new annotations can be added and saved. To keep the legacy annotations, process such a document once on the .NET 6 or .NET Framework build. A related issue with re-saved presentations (PPTX) whose annotations could not be read back is fixed on all frameworks. (ANNOTATIONNET-1903)
  • PDF page rotation by 90 degrees – rotating a PDF page with Annotator.Rotation worked for 180 and 270 degrees, but a 90-degree rotation was lost on save. It is now kept for every angle, and annotations on the page are positioned as before. (ANNOTATIONNET-2689)
using (Annotator annotator = new Annotator("input.pdf"))
{
    annotator.ProcessPages = 1;                 // the page to rotate
    annotator.Rotation = RotationDocument.on90; // previously ignored
    annotator.Save("output.pdf");
}

:link: Resources

As always, if you run into any issues or have questions after upgrading, please open a new topic and we’ll be happy to help. If your application renders documents with remote images or style sheets, please review the external resources section above before upgrading.