Vulnerability Description
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This issue was fixed in PDF Export Module version 0.7.6.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dhtmlx | Pdf Export Module | >= 0.3.3, < 0.7.6 |
Related Weaknesses (CWE)
References
- https://cert.pl/en/posts/2026/05/CVE-2026-7182Third Party Advisory
- https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=FixeRelease Notes
FAQ
What is CVE-2026-41552?
CVE-2026-41552 is a vulnerability with a CVSS score of 7.5 (HIGH). PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could inclu...
How severe is CVE-2026-41552?
CVE-2026-41552 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41552?
Check the references section above for vendor advisories and patch information. Affected products include: Dhtmlx Pdf Export Module.