QSearchQSearch

CVE-2026-41553

10.0 CRITICAL

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sa...

Published: 2026-05-15 · Last updated: 2026-05-18

Severity and scoring

CVSS
10.0 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
CWE-78

Affected products

VendorProduct
dhtmlxpdf_export_module

Description

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise. This issue was fixed in PDF Export Module version 0.7.6.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-41552 — PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization (7.5 HIGH)

Same CWE

  • CVE-2026-42846 — ClipBucket v5 is an open source video sharing platform (9.8 CRITICAL)
  • CVE-2026-45172 — Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0....
  • CVE-2026-48547 — KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands ... (7.3 HIGH)
  • CVE-2026-49261 — MariaDB server is a community developed fork of MySQL server (10.0 CRITICAL)
  • CVE-2026-49219 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.5 MEDIUM)