CVE-2026-41553

The vulnerability results from the lack of validation and sanitization of the 'data' parameter value passed to the PDF Export Module. An attacker can inject malicious JavaScript code, which is then processed and executed by the Node.js environment on the server side. This is a classic case of command injection (CWE-78) — an unauthenticated remote user can provide a specially crafted payload without any additional prerequisites.

Successful exploitation of the vulnerability leads to complete server compromise, including the ability to execute arbitrary system commands with Node.js process privileges. An attacker can read system files, install malicious software, or conduct further lateral movement in the network.

The PDF Export Module must be immediately updated to version 0.7.6 or later, in which the RCE vulnerability and file read vulnerability have been removed. Update information is available in the DHTMLX vendor documentation (PDF Export module changelog).

PDF Export Module (DHTMLX component) in versions prior to 0.7.6, used in DHTMLX Gantt and DHTMLX Scheduler products.