CVE-2026-41552 Overview
CVE-2026-41552 is a path traversal vulnerability in the DHTMLX PDF Export Module used by the DHTMLX Gantt and Scheduler products. The module fails to sanitize HTML input before processing, allowing unauthenticated attackers to craft payloads that reference local files on the server. When the PDF is rendered, the contents of those files are embedded in the output and returned to the attacker. The flaw is tracked as [CWE-22] and affects all PDF Export Module versions prior to 0.7.6.
Critical Impact
An unauthenticated remote attacker can read arbitrary files from the host filesystem by injecting crafted HTML into the PDF export workflow, exposing configuration files, credentials, and source code.
Affected Products
- DHTMLX PDF Export Module versions prior to 0.7.6
- DHTMLX Gantt (when bundled with vulnerable PDF Export Module)
- DHTMLX Scheduler (when bundled with vulnerable PDF Export Module)
Discovery Timeline
- 2026-05-15 - CVE-2026-41552 published to NVD
- 2026-05-19 - Last updated in NVD database
Technical Details for CVE-2026-41552
Vulnerability Analysis
The DHTMLX PDF Export Module converts HTML input into PDF documents for the Gantt and Scheduler client-side products. The module accepts HTML markup from the request body and renders it server-side without sanitizing tags that reference external resources. Attackers can supply HTML elements such as <img>, <link>, or <iframe> with src or href attributes pointing to local filesystem paths. The rendering engine resolves those references, reads the file contents, and embeds them in the resulting PDF.
Because the module does not require authentication on the export endpoint by default, any network-reachable attacker can trigger the read. Sensitive targets include /etc/passwd, application configuration files, private keys, and any file readable by the Node.js process user.
Root Cause
The root cause is missing HTML sanitization in the PDF generation pipeline. The module trusts user-supplied markup and does not filter file:// URIs, relative path traversal sequences such as ../../, or local filesystem references in resource-loading attributes. The renderer then dereferences these paths using the privileges of the server process.
Attack Vector
The attack vector is a network request to the PDF export endpoint exposed by an application embedding the DHTMLX PDF Export Module. An attacker submits a POST request containing HTML with a crafted resource reference. The server renders the HTML, reads the targeted local file, and returns a PDF containing the leaked contents. No authentication, user interaction, or prior access is required.
No verified public proof-of-concept code is available. See the CERT Poland security advisory for additional technical context.
Detection Methods for CVE-2026-41552
Indicators of Compromise
- HTTP POST requests to PDF export endpoints containing file:// URI schemes or ../ traversal sequences in HTML attributes
- Unexpected PDF generation requests from external IP addresses targeting Gantt or Scheduler endpoints
- PDF output files containing fragments of server-side configuration, /etc/passwd, or application source code
- Access log entries showing the rendering process reading files outside the application's static asset directories
Detection Strategies
- Inspect inbound HTTP request bodies for HTML payloads containing file://, \\?\, or path traversal patterns directed at the PDF export route
- Correlate web server access logs with filesystem audit logs to flag PDF export requests followed by reads of sensitive files
- Deploy web application firewall rules that block HTML attributes with non-HTTP resource schemes in requests to DHTMLX export endpoints
Monitoring Recommendations
- Enable verbose logging on the PDF Export Module process to capture all resource resolution attempts
- Monitor the application service account for unexpected reads of files outside the web root
- Alert on PDF response payloads that exceed normal size baselines or contain text matching sensitive file signatures
How to Mitigate CVE-2026-41552
Immediate Actions Required
- Upgrade the DHTMLX PDF Export Module to version 0.7.6 or later across all Gantt and Scheduler deployments
- Audit access logs for the PDF export endpoint to identify prior exploitation attempts
- Rotate any credentials, API keys, or certificates stored in files readable by the application service account
- Restrict network access to the PDF export endpoint to authenticated users where the application architecture permits
Patch Information
DHTMLX fixed the vulnerability in PDF Export Module version 0.7.6. The release notes confirm remediation of both Remote Code Execution and File Read vulnerabilities. See the DHTMLX PDF Export Module release notes for upgrade instructions.
Workarounds
- Place the PDF export service behind an authenticated reverse proxy until the upgrade is applied
- Run the PDF Export Module process under a dedicated low-privilege user with read access limited to its working directory
- Apply a web application firewall rule to strip or reject HTML attributes containing file:// schemes or ../ sequences on requests to the export route
# Upgrade the DHTMLX PDF Export Module to the patched release
npm install @dhx/pdf-export-module@0.7.6
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
