PT-2026-41297 · Dhtmlx · Dhtmlx Diagram

Łukasz Jaworski + 1 · Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-7182

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DHTMLX Diagram versions prior to 1.1.1

Description The export module is susceptible to Path Traversal in the src attribute because of insufficient HTML sanitization. An unauthenticated attacker can craft a malicious HTML payload to read arbitrary local files from the server and include their content in the generated PDF.

Recommendations Update to version 1.1.1.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7182

Affected Products

Dhtmlx Diagram

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7182 · Security Note
• https://docs.dhtmlx.com/diagram/whats_new/#version-612 · Note
• https://twitter.com/UpwindMDR/status/2055344047812743506 · Twitter Post
• https://dhtmlx.com/docs/products/dhtmlxDiagram · Note
• https://cert.pl/en/posts/2026/05/CVE-2026-7182 · Note