PT-2026-41296 · Dhtmlx · Pdf Export Module

Łukasz Jaworski + 1 · CVE-2026-41553 · Published 2026-05-15 · Updated 2026-05-18

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions PDF Export Module versions prior to 0.7.6

Description The PDF Export Module used in DHTMLX Gantt and Scheduler allows unauthenticated remote code execution. The issue stems from insufficient sanitization of the data parameter. An attacker can inject malicious JavaScript code into this parameter, which is then processed and executed by Node.js, potentially leading to full server compromise.

Recommendations Update to version 0.7.6. As a temporary workaround, restrict access to the data parameter within the PDF Export Module to minimize the risk of exploitation.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-41553

Affected Products

Pdf Export Module

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-41553 · Security Note
• https://t.me/cveNotify/163889 · Telegram Post
• https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=Fixed%20Remote%20Code%20Execution%20and%20File%20Read%20vulnerabilities · Note
• https://t.me/CVEtracker/53917 · Telegram Post
• https://cert.pl/en/posts/2026/05/CVE-2026-7182 · Note
• https://twitter.com/UpwindMDR/status/2055341223045378207 · Twitter Post