CVE-2026-7182

Critical

Description

Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in version 1.1.1.

SeverityCritical

CVSS9.2

Exploit probability—

Product

Diagram

PublishedMay 15, 2026

First seenMay 15, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

DHTMLX Diagram1.1.1 or later

Vendor advisories

docs.dhtmlx.com/diagram/whats_new/#version-612

Affected products

Product	Affected versions	Fixed in
DHTMLX Diagram	1.0.0 ≤ v < 1.1.1	1.1.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.