CVE-2026-41553 — DHTMLX PDF Export Module: unauthenticated server-side JavaScript injection RCE (CVSS 4.0 score 10.0), with CVE-2026-41552 and CVE-2026-7182 path-traversal companions
CERT Polska disclosed three coordinated vulnerabilities in DHTMLX (Dinamika Web) JavaScript scheduling and diagram libraries on 2026-05-15 (CERT-PL, 2026-05-15; ENISA EUVD EUVD-2026-30537). The critical finding, CVE-2026-41553, is an unauthenticated RCE in the self-hosted DHTMLX PDF Export Module (a Node.js service that backs Gantt/Scheduler PDF generation). CERT-PL verbatim: "PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of data parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise." ENISA EUVD records the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — score 10.0. Mapped to T1190 Exploit Public-Facing Application + T1059.007 JavaScript with a server-side-execution twist (Node.js eval-equivalent). The companion CVE-2026-41552 (CVSS 4.0 score 9.2) is an unauthenticated local file inclusion in the same Gantt/Scheduler PDF export; CVE-2026-7182 (CVSS 4.0 score 9.2) is a path traversal in DHTMLX Diagram's export module (CERT-PL ties the src HTML attribute specifically to this Diagram CVE; affects versions before 1.1.1). Fixes: PDF Export Module 0.7.6 closes CVE-2026-41552 and CVE-2026-41553; Diagram 1.1.1 closes CVE-2026-7182. Why it matters to us: DHTMLX Gantt/Scheduler/Diagram are widely OEM-embedded in EU e-Government project-management portals, healthcare scheduling stacks, and municipal infrastructure-planning tools — the export module is often deployed on a separate internal host that operators forget about. EPSS at disclosure is 0.39 with no known exploitation, but a CVSS-10.0 unauthenticated RCE in a server-side Node.js component will be scanned for shortly. Defenders should enumerate exposed instances of the PDF Export Module endpoint, restrict its reachability to internal trusted origins, apply egress filtering on the Node.js process, and patch immediately. Detection concepts: alert on Node.js worker processes spawning child processes; web-server access logs containing data= parameters with JavaScript syntax (e.g. process., require(, child_process); outbound connections from the PDF export host outside normal callback patterns.
CVE Summary Table
| CVE | Product | CVSS | EPSS | KEV | Exploited | Patch | Source |
|---|---|---|---|---|---|---|---|
| CVE-2026-41225 | F5 BIG-IP / BIG-IQ (iControl REST) | 8.6 (v4) / 9.1 (v3.1) | n/a | No | No | Yes (May 2026 Quarterly) | F5 K000160932 |
| CVE-2026-41553 | DHTMLX PDF Export Module (Gantt / Scheduler) | 10.0 (CVSS 4.0) | 0.39 | No | No | Yes (0.7.6) | CERT-PL |
| CVE-2026-41552 | DHTMLX PDF Export Module — path traversal | 9.2 (CVSS 4.0) | n/a | No | No | Yes (0.7.6) | CERT-PL |
| CVE-2026-7182 | DHTMLX Diagram — export module path traversal | 9.2 (CVSS 4.0) | n/a | No | No | Yes (1.1.1) | CERT-PL |
| CVE-2026-44088 | KIR SzafirHost — JAR zip-polyglot bypass | 8.6 | n/a | No | No | Yes (1.2.1) | CERT-PL |
Defender actions
- Enumerate and isolate any DHTMLX PDF Export Module endpoints (Node.js service backing DHTMLX Gantt / Scheduler / Diagram exports in EU public-sector portals); patch PDF Export Module to 0.7.6 and Diagram to 1.1.1. CVE-2026-41553 is unauthenticated, CVSS 4.0 score 10.0 — assume opportunistic scanning starts within days of CERT-PL's coordinated disclosure. If the patch cannot land within 48 h, restrict the export service to internal trusted origins via network ACL and apply egress filtering on the Node.js worker process. Reference: § 2 DHTMLX item.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1059.007Command and Scripting Interpreter: JavaScript
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.