PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41552 DHTMLX CVE debrief

A critical path traversal vulnerability exists in DHTMLX's PDF Export Module, affecting versions from 0.3.3 through 0.7.5. The flaw stems from insufficient HTML sanitization in the PDF generation process, allowing unauthenticated remote attackers to embed malicious HTML payloads that can read arbitrary local files from the server and include their contents in generated PDF documents. The vulnerability was disclosed on May 15, 2026, with NVD analysis completed by May 19, 2026. DHTMLX addressed this issue in PDF Export Module version 0.7.6, which also remediated related remote code execution vulnerabilities. Organizations using affected versions should prioritize upgrading to 0.7.6 or later, as the unauthenticated nature of this vulnerability and high confidentiality impact present significant exposure risk.

Vendor
DHTMLX
Product
PDF Export Module
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations using DHTMLX Gantt or Scheduler with PDF Export Module versions 0.3.3 through 0.7.5; development teams implementing server-side PDF generation from HTML content; security teams monitoring for path traversal vulnerabilities in document processing pipelines

Technical summary

The PDF Export Module in DHTMLX Gantt and Scheduler products fails to properly sanitize HTML content during PDF generation. An unauthenticated attacker can craft a malicious HTML payload containing file inclusion directives that the PDF generation process resolves against the server's local filesystem. The rendered PDF then contains the contents of arbitrary files readable by the service account. This represents a classic path traversal vulnerability (CWE-22) where user-controlled input influences filesystem operations without adequate validation or sanitization. The vulnerability is particularly severe given the unauthenticated attack vector and the common deployment pattern of PDF export services with access to sensitive configuration files.

Defensive priority

critical

Recommended defensive actions

  • Upgrade DHTMLX PDF Export Module to version 0.7.6 or later
  • Review PDF generation endpoints for unauthorized access patterns
  • Audit server file access logs for anomalous read operations from PDF export processes
  • Implement network segmentation to limit PDF export service exposure
  • Validate HTML input sanitization in custom PDF generation implementations

Evidence notes

CVE published 2026-05-15; NVD analysis completed 2026-05-19. CERT.PL advisory confirms vulnerability details. DHTMLX release notes document fix in version 0.7.6. CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, high confidentiality impact to vulnerable system, and high confidentiality impact to subsequent systems.

Official resources

2026-05-15T13:16:18.990Z