CVE-2026-41552Disclosure(dhtmlx / pdf_export_module)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This issue was fixed in PDF Export Module version 0.7.6.

dhtmlx CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://cert.pl/en/posts/2026/05/CVE-2026-7182

Other references

https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=Fixed%20Remote%20Code%20Execution%20and%20File%20Read%20vulnerabilities

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

pdf_export_module

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

dhtmlx

Products

pdf_export_module

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Upwind Security MDR@UpwindMDR148d
Disclosure
🚨Critical - DHTMLX PDF Export Module Critical RCE + Path Traversal (CVE-2026-41552 & CVE-2026-41553) The PDF Export Module used in DHTMLX Gantt, Scheduler and other products contains two critical vulnerabilities: CVE-2026-41553: Lack of sanitization on the "data" parameter allows unauthenticated Remote Code Execution (OS Command Injection) via Node.js. CVE-2026-41552: Path Traversal allows unauthenticated attackers to read arbitrary files on the server and include them in generated PDFs. 👉Affected: PDF Export Module < 0.7.6
Post summary
The post announces critical Remote Code Execution and Path Traversal vulnerabilities (CVE-2026-41552 and CVE-2026-41553) in the DHTMLX PDF Export Module for versions below 0.7.6, detailing the affected parameters and potential impacts.
00030155
255 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dhtmlx	pdf_export_module	-	-	-

Explore more

Back to dashboard dhtmlx CVEs pdf_export_module vulnerabilities