Executive brief
DHTMLX Diagram is a JavaScript library used to create interactive charts and diagrams in web applications. A security flaw in its export module allows unauthorized users to access sensitive files on the server. By submitting specially crafted data to the PDF or PNG export function, an attacker could force the server to include local system files in the generated document, potentially leading to the exposure of private configuration or system data.
Technical details
The vulnerability exists in the export module of DHTMLX Diagram due to a lack of HTML sanitization when processing the 'src' attribute. An unauthenticated remote attacker can provide a crafted HTML payload to the export functions (PDF/PNG). Because the application fails to properly validate or sanitize file paths within the 'src' attribute, the attacker can use path traversal sequences to include and display local files from the server's filesystem within the resulting exported document. This issue was addressed in Diagram version 1.1.1 and version 6.1.2 through improved sanitization and environment hardening.
Affected products
- DHTMLX Diagram 1.0.0 to 1.1.1 (and fixed in 6.1.2)
Timeline
- 2026-04-02: patched: Fixed in version 6.1.2
- 2026-05-15: disclosed: Public disclosure by CERT Polska
- 2026-05-15: advisory: NVD publication date