CVE-2026-41552

7.5 Élevée

Publiée le 15/05/2026 à 15:16 · Modifiée le 17/06/2026 à 12:46 · Analysée par le NVD · Source : cvd@cert.pl

Description

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This issue was fixed in PDF Export Module version 0.7.6.

Traduire en français

Produits concernés

DHTMLX PDF Export Module

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.2 Critique	cvd@cert.pl	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.5 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-22

Références

https://cert.pl/en/posts/2026/05/CVE-2026-7182 Third Party Advisory
https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=Fixed%20Remote%20Code%20Execution%20and%20File%20Read%20vulnerabilities Release Notes

CVE-2026-41552

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs