CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

DHTMLX Diagram

product · product:dhtmlx-diagram

Coverage
1
first 2026-05-17 → last 2026-10-21
Latest activity
2026-05-17
DHTMLX PDF Export Module before 0.7.6 executes attacker JavaScript sent to it without authentication…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
5
3 hosts

Defender insights

What each entry about DHTMLX Diagram tells a defender to do, newest first.

2026-05-17NOTABLEDHTMLX PDF Export Module before 0.7.6 executes attacker JavaScript sent to it without authentication (CVE-2026-41553)

Exposure · detection

Story timeline

  1. 2026-05-17CVE-2026-41553: DHTMLX PDF Export Module executes JavaScript injected into its data parameter without authentication (CVSS 4.0 10.0), with two file-read flaws (CVE-2026-41552, CVE-2026-7182)
    trending-vulnerabilitiesDHTMLX PDF Export Module before 0.7.6 executes attacker JavaScript sent to it without authentication (CVE-2026-41553)

Hunting pivots

CVEs
CVE-2026-41552CVE-2026-41553CVE-2026-7182
Releases covered
DHTMLX Diagram
Tags
patch-availablepath-traversalpre-authrcevulnerabilities
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: JavaScript
  • CollectionData from Local System

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-17/cve-2026-41553-dhtmlx-pdf-export-module-unauthenticated-serv · ATT&CK page ↗

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-05-17/cve-2026-41553-dhtmlx-pdf-export-module-unauthenticated-serv · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-05-17/cve-2026-41553-dhtmlx-pdf-export-module-unauthenticated-serv · ATT&CK page ↗

Entries about DHTMLX Diagram (1)

2026-05-17 · view entry permalink →

NOTABLECVE-2026-41553 +2updatedNATOA2

CVE-2026-41553: DHTMLX PDF Export Module executes JavaScript injected into its data parameter without authentication (CVSS 4.0 10.0), with two file-read flaws (CVE-2026-41552, CVE-2026-7182)

CERT Polska coordinated the disclosure of three vulnerabilities in DHTMLX software on 2026-05-15, reported by Łukasz Jaworski and Tomasz Holeksa of Pentest Limited (CERT Polska, 2026-05-15). In CVE-2026-41553 the PDF Export Module used by DHTMLX Gantt and Scheduler does not sanitize its data parameter, so an unauthenticated attacker can inject JavaScript that Node.js processes and executes, which can lead to server compromise; CVE-2026-41552 in the same module and CVE-2026-7182 in Diagram's export module (through the src attribute) lack HTML sanitization, so a crafted payload can include local files from the server in the generated PDF (CERT Polska, 2026-05-15). ENISA's EUVD carries CERT-PL's CVSS 4.0 scores of 10.0 for CVE-2026-41553 and 9.2 for each file-read flaw, all with a network vector, no privileges and no user interaction (ENISA EUVD-2026-30537; ENISA EUVD-2026-30538; ENISA EUVD-2026-30539). PDF Export Module version 0.7.6 fixes CVE-2026-41552 and CVE-2026-41553 and Diagram version 1.1.1 fixes CVE-2026-7182 (CERT Polska, 2026-05-15), and EUVD lists the module from 0.3.3 and Diagram from 1.0.0 as affected below those releases (ENISA EUVD-2026-30537; ENISA EUVD-2026-30539); DHTMLX's changelog for release 0.7.6 records fixed remote code execution and file read vulnerabilities (DHTMLX PDF Export Module changelog). No source reports exploitation.

An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed.

Vulnerabilities CVE-2026-41552 and CVE-2026-41553 were fixed in PDF Export Module version 0.7.6.

CERT Polska 2026-05-15

Fixed Remote Code Execution and File Read vulnerabilities

DHTMLX
Correctionrun 2026-10-21T1148Z-auditactionsaffected_productsbodyclassificationcvesevidenceheadlinepriorityregionssectorssourcessourcing_notesummarytagstechniquestitle

CERT Polska's advisory names the vendor, the products and the affected ranges and says nothing about where DHTMLX components are deployed, so the claim that they are widely embedded in EU e-government, healthcare scheduling and municipal planning tools has no source (CERT Polska, 2026-05-15). The disclosure covers the PDF Export Module used by DHTMLX Gantt and Scheduler and the export module of DHTMLX Diagram, not the scheduling and diagram libraries as a whole (CERT Polska, 2026-05-15). CVE-2026-41552 and CVE-2026-7182 are path-traversal flaws that let crafted HTML include local server files in the generated PDF rather than code execution, with CVSS 4.0 scores of 9.2 (ENISA EUVD-2026-30538; ENISA EUVD-2026-30539). The PDF Export Module is affected from release 0.3.3 and fixed in 0.7.6, and Diagram from 1.0.0 and fixed in 1.1.1 (ENISA EUVD-2026-30537; CERT Polska, 2026-05-15).

vulnerability17 May 05:00Zmulti-sourceOpen finding →
Sources: CERT Polska · ENISA EUVD (EUVD-2026-30537) · ENISA EUVD (EUVD-2026-30538) · ENISA EUVD (EUVD-2026-30539) · DHTMLX

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • euvd.enisa.europa.eu3 (60%)
  • cert.pl1 (20%)
  • docs.dhtmlx.com1 (20%)
All cited sources (5)