CVE-2026-41552CWE-22

Path Traversal in PDF Export Module

Critical · published May 15, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include

local files from the server and display them in the generated PDF.

This issue was fixed in PDF Export Module version 0.7.6.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00552 · 45.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-15T12:31Z
EPSS history
Timeline
  • 15 MAY 12:31Z
    Path Traversal in PDF Export Module
    cvelistv5