DHTMLX Diagram CVE-2026-7182

Upgrade to DHTMLX Diagram version 1.1.1 or later, which includes the vendor-released fix confirmed in the changelog at https://docs.dhtmlx.com/diagram/whats_new/#version-612. Organizations unable to immediately upgrade should implement compensating controls: disable the export module entirely if PDF generation is not business-critical (eliminates attack surface but removes functionality), restrict export functionality to authenticated users only with rate limiting (reduces exposure but does not prevent exploitation by authenticated attackers), or deploy input validation that blocks file:// protocol handlers and absolute filesystem paths in all user-supplied HTML attributes before passing data to the export module (requires custom validation logic and may break legitimate use cases if diagrams reference external resources). For defense in depth, run the export service in a restricted container or sandbox with minimal filesystem access limited to explicitly required directories (reduces blast radius but adds operational complexity and may impact performance). Review server logs for suspicious export requests containing file paths or file:// schemes to detect potential exploitation attempts during the vulnerability window.