CVE-2026-41553

10.0 Critique

Publiée le 15/05/2026 à 15:16 · Modifiée le 17/06/2026 à 12:46 · Analysée par le NVD · Source : cvd@cert.pl

Description

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise. This issue was fixed in PDF Export Module version 0.7.6.

Traduire en français

Produits concernés

DHTMLX PDF Export Module

Scores CVSS

Version	Score	Source	Vecteur
4.0	10.0 Critique	cvd@cert.pl	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	10.0 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://cert.pl/en/posts/2026/05/CVE-2026-7182 Third Party Advisory
https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=Fixed%20Remote%20Code%20Execution%20and%20File%20Read%20vulnerabilities Release Notes

CVE-2026-41553

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs