Executive brief
The PDF Export Module used in DHTMLX Gantt and Scheduler products is vulnerable to a security flaw that allows unauthorized access to server files. By sending a specially crafted request, an attacker can force the server to include sensitive local files in a generated PDF document. This could lead to the exposure of configuration files, credentials, or other private data stored on the host server.
Technical details
A path traversal vulnerability exists in the DHTMLX PDF Export Module (versions 0.3.3 through 0.7.5) used by the Gantt and Scheduler components. The root cause is a lack of proper HTML sanitization when processing user-supplied payloads for PDF generation. An unauthenticated remote attacker can submit a crafted HTML payload containing directory traversal sequences (e.g., in 'src' attributes) to include arbitrary local files from the server in the resulting PDF output. This vulnerability was addressed in version 0.7.6 by improving HTML content sanitization.
Affected products
- DHTMLX PDF Export Module 0.3.3 to 0.7.5
- DHTMLX Gantt
- DHTMLX Scheduler
Timeline
- 2026-05-15: advisory: CERT Polska published advisory CVE-2026-41552
- 2026-05-15: patched: Fixed in PDF Export Module version 0.7.6