CVE Intelligence
Analysis AI-assisted

CVE-2026-41553: DHTMLX PDF Export Module: Remote Code Execution

The PDF Export Module used in DHTMLX Gantt and Scheduler has a remote code execution flaw because the "data" parameter is not sanitized. The record describes exploitation without authentication, and NVD and CERT-PL both assign a CVSS base score of 10. The issue is fixed in PDF Export Module 0.7.6, and the sources consulted show no confirmed exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The DHTMLX PDF Export Module, used with the Gantt and Scheduler products, contains a remote code execution flaw. According to the record, the "data" parameter is not sanitized, and values sent to it are processed by Node.js and then executed.

Impact

The record states that successful exploitation can lead to server compromise. NVD and CERT-PL both report a CVSS base score of 10, and the SSVC data in the record rates technical impact as total. The record also marks the issue as automatable.

Affected products and versions

  • DHTMLX PDF Export Module before 0.7.6.
  • The record also lists a range from 0.3.3 up to before 0.7.6.
  • Versions before 0.3.3 are not addressed by the listed ranges, so their status is unknown from this record.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted. The record shows an EPSS probability of 0.01049 and an SSVC exploitation value of none.

Remediation and mitigation

  • Upgrade the PDF Export Module to version 0.7.6 or later, as stated in the vendor release notes.
  • Until the upgrade is complete, limit which networks and users can reach PDF export functionality, and review whether it is exposed to unauthenticated users.
  • Inventory every deployment of DHTMLX Gantt and Scheduler that includes the PDF Export Module.

Detection guidance

  • Review web server and application logs for unusual requests to PDF export endpoints.
  • Monitor the Node.js service for unexpected child processes, file access or outbound connections.
  • Correlate these signals with request timestamps and source addresses to identify possible misuse.

Limitations of the available information

  • The record does not describe the affected endpoint, request format or proof of concept, and it does not include a patch diff.
  • The fixes field in the record is empty, although the description and vendor release note state the fix is in 0.7.6.
  • The CWE assigned is OS Command Injection (CWE-78), while the description refers to JavaScript processed by Node.js; the record does not explain the mapping.
  • The CERT-PL advisory link uses the identifier CVE-2026-7182 in its address, which differs from this CVE ID, so the linkage is not verified from the record alone.

Frequently asked questions

Is this CVE listed in CISA KEV?

According to the record, it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which version fixes the issue?

The record's description and the vendor release note indicate that PDF Export Module 0.7.6 contains the fix.

Which versions are affected?

The record lists versions before 0.7.6 and a range from 0.3.3 up to before 0.7.6. Older versions are not covered by these ranges.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.