PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 15, 2026 · NIST NVD

   Detected

   PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This issue was fixed in PDF Export Module version 0.7.6.

2. Jun 17, 2026 · NIST NVD

   Updated

   PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This issue was fixed in PDF Export Module version 0.7.6.

Affected

• cpe dhtmlx/pdf export moduleversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-41552

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-41552

  PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF. This i

  nvd.nist.gov

References

• Third Party Advisory · cert.pl
• Release Notes · docs.dhtmlx.com