CVE-2026-7182

9.2 Critique

Publiée le 15/05/2026 à 15:16 · Modifiée le 17/06/2026 à 13:01 · En attente d'analyse NVD · Source : cvd@cert.pl

Description

Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in version 1.1.1.

Traduire en français

Produits concernés

DHTMLX Diagram

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.2 Critique	cvd@cert.pl	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-22

Références

https://cert.pl/en/posts/2026/05/CVE-2026-7182
https://dhtmlx.com/docs/products/dhtmlxDiagram/
https://docs.dhtmlx.com/diagram/whats_new/#version-612

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories