CVE-2026-7182: Diagram export module path traversal in PDF generation

Overview

CVE-2026-7182 is a path traversal weakness (CWE-22) in the export module of Diagram. According to the record, the export module does not sanitize HTML before handling the src attribute, so local files from the server can be shown inside the generated PDF. The record was published on 2026-05-15 by CERT Polska (cvd@cert.pl) and its source status is Awaiting Analysis.

Impact

• The description states that local files from the server can be included in the generated PDF, which may expose data stored on the host.
• The description states that an unauthenticated user could trigger this condition.
• CERT Polska scored the issue 9.2 under CVSS 4.0 with severity critical. The vector records high confidentiality impact on the vulnerable system and no integrity or availability impact there.
• The specific files or data categories exposed are unknown from the record.

Affected products and versions

• The record contains no structured list of affected products or versions.
• The description refers to the export module of Diagram. The references point to dhtmlx Diagram documentation, which suggests the product is dhtmlxDiagram. This link is an inference.
• The description states the issue was fixed in version 1.1.1. The vulnerable version range before that fix is unknown from the record.

Exploitation status

• The record shows the vulnerability is not listed in the CISA KEV catalog.
• No confirmed exploitation in the wild appears in the sources consulted.
• The record gives an EPSS probability of 0.00546 and a percentile of 0.44253, dated 2026-10-13.

Remediation and mitigation

• Update the affected Diagram export component to version 1.1.1 or later, as stated in the description. Confirm the exact fixed build with the vendor documentation before deployment.
• If an immediate update is not possible, limit access to the export feature to trusted users and review whether it is exposed to unauthenticated requests.
• Apply least privilege to the service account that generates PDFs so that it can read only the directories it needs.
• Review existing generated PDFs for unexpected server content if the export feature was exposed.

Detection guidance

• Monitor export requests for unauthenticated sources, unusual payload sizes, or embedded HTML references to file paths outside expected locations.
• Review application logs for export operations that reference local paths.
• Consider alerting when generated documents contain content that does not match the expected report data.

Limitations of the available information

• The record has no title, no affected version list, and no fixed-version list beyond the statement in the description.
• The product name is not stated explicitly in the description.
• The exposed file types and the full impact scope are not described.
• No vendor advisory was included in the record beyond the links listed in references.

Frequently asked questions

What is CVE-2026-7182?

It is a path traversal weakness (CWE-22) in the export module of Diagram. Missing HTML sanitization of the src attribute can let local server files appear in generated PDFs.

Which version fixes it?

The description states the issue is fixed in version 1.1.1. The record does not provide a structured list of affected versions, so check the vendor documentation for details.

Is it being exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.