CVE-2026-41552

High

Description

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This issue was fixed in PDF Export Module version 0.7.6.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Dhtmlx Pdf Export Module

PublishedMay 15, 2026

First seenMay 15, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

dhtmlx pdf_export_module0.7.6 or later

Vendor advisories

docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=Fixed%20Remote%20Code%20Execution%20and%20File%20Read%20vulnerabilities

Affected products

Product	Affected versions	Fixed in
dhtmlx pdf_export_module	0.3.3 ≤ v < 0.7.6	0.7.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.