CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2026-41552

CVSS 9.2v4.0pub. 2026-05-15upd. 2026-05-19

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This issue was fixed in PDF Export Module version 0.7.6.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Dhtmlx Pdf Export Module

    APP
    Dhtmlx
    0.3.3 – 0.7.6 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2026-41553CRITICAL10.0PL ✓ten sam produkt

RCE i command injection w PDF Export Module DHTMLX (Gantt/Scheduler)

CVE-2024-55213MEDIUM6.5ten sam vendor

Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive i...

CVE-2024-55214MEDIUM6.5ten sam vendor

Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive ...

CVE-2013-6281MEDIUM4.3ten sam vendor

Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) pl...