EUVD-2026-30538
GHSA-cj88-m5vv-89m3
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionNVD
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated PDF.
This issue was fixed in PDF Export Module version 0.7.6.
AnalysisAI
Path traversal in DHTMLX PDF Export Module (used by Gantt and Scheduler) allows remote unauthenticated attackers to read arbitrary local files from the server and embed them in generated PDFs. The vulnerability stems from insufficient HTML sanitization in the module's PDF generation process. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all deployments of DHTMLX Gantt and Scheduler and their current PDF Export Module versions. Within 7 days: Upgrade DHTMLX PDF Export Module to version 0.7.6 or later across all affected Gantt and Scheduler instances; verify upgrades in test environments first. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today