We’re happy to announce the release of GroupDocs.Conversion for .NET v26.10, available as of October 2026. This release is about control over what a document is allowed to load: your code can now decide about every external resource a document asks for, and the defaults are safe for documents from unknown sources. It also makes conversions honour the requested output format and page selection, fixes a range of conversion failures and .NET Framework loading problems, and updates a security-sensitive dependency — 60 features, improvements, and bug fixes in total.

Highlights

Decide what each document may load

Documents often point outside themselves: images on a CDN, stylesheets, scripts, 3D textures, XBRL taxonomies. In 26.10 you can see each of these requests and decide about it in code. Implement IExternalResourceHandler and set it through the ExternalResourceHandler property of the load options. The handler receives every resource with the default decision already filled in, and can allow it, skip it or — for most formats — supply the content itself, for example from your own cache, so nothing is requested at all.

This handler loads JPEG images from one trusted host on top of what the defaults allow:

public class TrustedJpegHandler : IExternalResourceHandler
{
    public void OnLoading(ExternalResourceLoadingArgs args)
    {
        Uri uri;
        if (Uri.TryCreate(args.Uri, UriKind.Absolute, out uri)
            && uri.Scheme == Uri.UriSchemeHttps
            && string.Equals(uri.Host, "cdn.example.com", StringComparison.OrdinalIgnoreCase)
            && (uri.AbsolutePath.EndsWith(".jpg", StringComparison.OrdinalIgnoreCase)
                || uri.AbsolutePath.EndsWith(".jpeg", StringComparison.OrdinalIgnoreCase)))
        {
            args.Skipped = false;
        }
    }
}

WebLoadOptions loadOptions = new WebLoadOptions
{
    ExternalResourceHandler = new TrustedJpegHandler()
};
using (Converter converter = new Converter("sample.html", (LoadContext loadContext) => loadOptions))
{
    converter.Convert("converted.pdf", new PdfConvertOptions());
}

The handler works with the load options for web, XML, word processing, spreadsheet, CSV and TSV, presentation, e-mail, SVG, finance and 3D documents.

Safe defaults for untrusted documents

Converting a file someone uploaded should not make your server read other files or reach out to arbitrary hosts. With default settings, 26.10:

  • loads local files only from the document’s own folder, and never from UNC paths;
  • does not run scripts in HTML, MHTML, XHTML and SVG documents, and requests no script files;
  • applies the same rules to SVG, 3D models, XBRL, XSL-FO, Markdown and e-mail-to-spreadsheet conversions.

When your documents legitimately need outside resources, allow them the way that fits: list trusted locations in WhitelistedResources, decide per resource with the handler, or set SkipExternalResources = false for documents you trust. Scripts run only when you set ExecuteScripts = true on WebLoadOptions or SvgLoadOptions. UNC paths and javascript: or vbscript: references are never loaded, whatever the settings.

The output you asked for

Some conversions ignored part of the request. Several always wrote DOCX, XLSX, PPTX or a multi-frame TIFF whatever target format you chose, and page selection was ignored for e-mail, web and multi-page TIFF to word processing, for Word Flat OPC documents, and for Project to PS and PCL. All of them now produce what the convert options ask for. Watermarks now also appear when converting non-image documents to images and when converting CSV and TSV, MHT and MHTML pages render instead of showing their MIME source, and transparent backgrounds no longer turn black in J2K, JP2, WMF and WMZ output.

Fewer failed conversions

PostScript files that use the run or file operator on .NET Framework, PSD, PSB and AI documents page by page, whole CAD drawings to TeX, XHTML with inline SVG, PDF, XPS and SVG to EPUB, and Visio and SVG to spreadsheet now convert instead of failing. In e-mail, mailbox and archive files, an attachment that cannot be converted to the target format no longer fails the whole conversion, and a contained document that cannot be loaded is now reported through ConversionEvents.OnDocumentFailed.

Security, licensing and .NET Framework

  • System.Security.Cryptography.Pkcs moves to 8.0.2 (10.0.13 on .NET 10), addressing CVE-2026-84008 and CVE-2026-70162.
  • .NET Framework projects no longer fail to load RuntimeInformation or ValueTuple, and EML, HTML and CAD conversions no longer fail on .NET Framework 4.6.2 to 4.7.0.
  • WebP conversions with a valid license no longer carry the trial badge. In evaluation mode, the 3-page limit now also applies to SVG, SVGZ, PS and PCL output.

What’s new in this release

  • [Feature] Add a per-resource callback to inspect, allow, deny or supply each external resource a document loads
  • [Improvement] Offer SvgLoadOptions as the load options for SVG and SVGZ documents
  • [Improvement] Name OLM and NSF items without a subject by folder and position and avoid reserved Windows device names in mailbox item names
  • [Improvement] Report archive, email and mailbox items that cannot be loaded to the document-failed handler instead of only logging them
  • [Bug] Trial badge is applied when converting from Webp even when a valid license is applied
  • [Bug] Specific VSDX file conversion - text out of box bounds
  • [Bug] Double strikethrough text not preserved in ODT to PDF conversion
  • [Bug] VCF to Excel conversion problems
  • [Bug] Fix conversions failing to load RuntimeInformation in old-style .NET Framework 4.7.1+ projects that use PackageReference
  • [Bug] Fix conversions failing to load RuntimeInformation or ValueTuple in .NET Framework packages.config projects
  • [Bug] Fix EML, HTML, and CAD conversions failing on .NET Framework 4.6.2 to 4.7.0 runtimes
  • [Bug] Converting WordProcessing, Pdf and ProjectManagement documents to any spreadsheet format always produces XLSX
  • [Bug] Converting WordProcessing, Pdf and Diagram documents to any presentation format always produces PPTX
  • [Bug] Fix PST, OST and MBOX conversion failing on an item without a subject and PST sticky notes converting to unreadable text
  • [Bug] Converting a single-page document to a non-TIFF image format always produces a multi-frame TIFF
  • [Bug] [GroupDocs.Conversion for .NET] Update System.Security.Cryptography.Pkcs to 8.0.2 (CVE-2026-84008 / CVE-2026-70162)
  • [Bug] Text or image watermark is not applied when converting non-image documents to images
  • [Bug] Transparent page background turns black when converting to J2K, JP2, WMF and WMZ
  • [Bug] WMZ output of Word-based documents holds a gzipped PNG and EMZ output of images is gzipped twice
  • [Bug] MHT and MHTML pages converted to images show the MIME source instead of the page
  • [Bug] Document info of a Publisher document always reports one page
  • [Bug] Watermark is not applied when converting CSV and TSV documents
  • [Bug] Load external resources only from exact whitelisted URL prefixes and the document’s own folder, never from UNC paths
  • [Bug] Fix CAD, Image, Diagram, DjVu, VCF and Email to WordProcessing saving DOCX for every target except DOC
  • [Bug] Fix Email to WordProcessing ignoring page selection and page range
  • [Bug] Fix multi-page TIFF to WordProcessing ignoring page selection
  • [Bug] Respect SkipExternalResources and WhitelistedResources when converting Markdown and CHM documents
  • [Bug] Respect SkipExternalResources and WhitelistedResources in email-to-spreadsheet, spreadsheet and page-range conversions
  • [Bug] Do not load images from outside the document’s folder by default when converting HTML to a spreadsheet
  • [Bug] Do not load external resources by default when converting SVG to presentation, word processing, spreadsheet, XPS or EPS
  • [Bug] Do not load 3D material libraries, textures and buffers from outside the model’s folder by default
  • [Bug] Do not load external images by default when converting XML through an XSL-FO stylesheet
  • [Bug] Fix HTML and MHTML to WordProcessing saving DOCX for every target
  • [Bug] Do not load XBRL and inline XBRL taxonomies from outside the document’s folder by default
  • [Bug] Stop running scripts and downloading script files when converting HTML, XHTML and SVG documents
  • [Bug] Fix Web to WordProcessing ignoring page selection and page range
  • [Bug] Fix Word Flat OPC documents ignoring page selection and page range
  • [Bug] Do not embed textures from outside the model’s folder by default when converting 3D documents
  • [Bug] Fix single-stream compression archives converting their file without a name
  • [Bug] Fix javascript: and vbscript: references being fetched when external resources are allowed
  • [Bug] Fix XHTML documents with inline SVG failing to convert
  • [Bug] Fix HTML to HTML conversion failing when a relative CSS @import cannot be loaded
  • [Bug] Fix Visio and SVG to spreadsheet conversion failing on a page with nothing to draw
  • [Bug] Fix PDF, XPS and SVG to EPUB conversion failing on a hyperlink that covers no text
  • [Bug] Fix email, mailbox and archive conversion failing on an attachment that cannot be converted to the target format
  • [Bug] Fix PCL conversion replacing Courier New and other installed fonts after a PDF has been converted
  • [Bug] GroupDocs.Conversion.LowCode 26.9.0: DOCX to PDF on Linux ignores font substitution and uses the alphabetically first font
  • [Bug] Fix XML documentation errors in GroupDocs.Conversion.LowCode 26.9.0
  • [Bug] Fix PostScript conversion failing on .NET Framework when a document uses the run or file operator
  • [Bug] Fix unlicensed conversions to page description language formats ignoring the trial page limit
  • [Bug] Fix page-by-page conversion of PSD, PSB and Illustrator AI documents failing with an exception
  • [Bug] Fix converting video to an audio format failing even when a video connector is set
  • [Bug] Fix ProjectManagement to PS and PCL conversion producing extra pages and ignoring page selection
  • [Bug] Fix ProjectManagement to SVG writing UTF-16 without a byte order mark
  • [Bug] Fix 3D to glTF and OBJ conversion writing buffer and material files into the working directory
  • [Bug] Fix MHT and MHTML conversions to PDF, XPS, TeX and WordProcessing showing the MIME source instead of the page
  • [Bug] Fix CAD to TeX conversion of a whole drawing failing with FileTypeNotSupported
  • [Bug] Fix PDL and XML/JSON to PS and PCL conversions adding extra pages
  • [Bug] Fix CAD to PS and PCL conversions keeping only one page of multi-page DWF drawings
  • [Bug] Fix MBOX conversion failing or dropping the email headers when a message subject looks like a file name

Public API changes

New API

  • IExternalResourceHandler and ExternalResourceLoadingArgs (Uri, Skipped, Data) in the GroupDocs.Conversion.Options.Load namespace.
  • ExternalResourceHandler on IResourceLoadingOptions and the load options that implement it.
  • ExecuteScripts on WebLoadOptions and SvgLoadOptions.
  • SkipExternalResources, WhitelistedResources and ExternalResourceHandler on FinanceLoadOptions and ThreeDLoadOptions, which now implement IResourceLoadingOptions.

⚠️ Check before you upgrade

  • External resources: documents that relied on local files outside their folder, UNC paths or scripts now convert without them. Allow what you trust as described in Safe defaults for untrusted documents.

  • Whitelist entries: each WhitelistedResources entry must be an absolute URI prefix, such as https://cdn.example.com/assets/ or file:///C:/assets/. Entries like jpg or example.com, which earlier versions matched anywhere in the URL, now make the load fail with InvalidLoadOptionsException.

  • XBRL and inline XBRL: a filing whose taxonomy lies outside its folder, or one loaded from a stream, now fails to load with InvalidLoadOptionsException. Load filings you trust like this:

    using (Converter converter = new Converter("filing.xbrl", (LoadContext loadContext) => new FinanceLoadOptions { SkipExternalResources = false }))
{
    converter.Convert("filing.xlsx", new SpreadsheetConvertOptions());
}

  • SVG and SVGZ: converted without load options, they now use SvgLoadOptions, and PossibleConversions.LoadOptions returns SvgLoadOptions instead of PageDescriptionLanguageLoadOptions.

  • Output format and pages: conversions now honour the requested format and page selection, so the output can differ from earlier versions for the same options. PublisherDocumentInfo.PagesCount now returns the real page count.

  • Custom IResourceLoadingOptions implementations must add the new ExternalResourceHandler property.

The release notes list every change with the exact exception messages.

How to get the update

NuGet

Upgrade to the latest GroupDocs.Conversion package via NuGet: GroupDocs.Conversion 26.10.0

dotnet add package GroupDocs.Conversion --version 26.10.0

Direct download

Download assemblies from the GroupDocs.Conversion for .NET 26.10 page

Resources