Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 15, 2026 · NIST NVD

   Detected

   Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in version 1.1.1.

2. Jun 17, 2026 · NIST NVD

   Updated

   Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in version 1.1.1.

Sources

• CVE.orgVulnerability recordCVE-2026-7182

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-7182

  Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in versi

  nvd.nist.gov

References

• Reference · cert.pl
• Reference · dhtmlx.com
• Reference · docs.dhtmlx.com