CVE-2026-41552

critical · 9.2

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This issue was fixed in PDF Export Module version 0.7.6.

9.2

CVSS

0.5%

EPSS (exploit prob.)

42nd

EPSS percentile

2026-05-15

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
dhtmlx	pdf_export_module	>= 0.3.3, < 0.7.6

Check a specific version with /api/v1/cve/match.

References

https://cert.pl/en/posts/2026/05/CVE-2026-7182
https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=Fixed%20Remote%20Code%20Execution%20and%20File%20Read%20vulnerabilities

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-41552