Vulnerability Details CVE-2026-41552
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include
local files from the server and display them in the generated PDF.
This issue was fixed in PDF Export Module version 0.7.6.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.2%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-41552
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.5.0
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.5.5
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.5.6
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.5.7
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.5.8
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.5.9
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.6.0
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.6.2
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.6.3
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.6.4
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.6.5
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.6.6
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.6.7
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.7.0
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.7.1
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.7.2
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.7.3
-
cpe:2.3:a:dhtmlx:pdf_export_module:0.7.4