DHTMLX flaws enable RCE and file disclosure
Three vulnerabilities in DHTMLX software—two path traversals and one RCE via unsanitized JavaScript—allow unauthenticated attackers to read server files or execute code.
CERT Polska coordinated disclosure of three vulnerabilities affecting DHTMLX products. CVE-2026-7182 in the Diagram export module allows path traversal via unsanitized HTML in the src attribute, enabling unauthenticated users to include and display local server files in generated PDFs. CVE-2026-41552 affects the PDF Export Module in DHTMLX Gantt and Scheduler with a similar path traversal issue.
The most severe issue is CVE-2026-41553, a remote code execution vulnerability in the PDF Export Module. Attackers can inject malicious JavaScript into an unsanitized data parameter that Node.js processes and executes, leading to full server compromise. All three flaws require no authentication.
DHTMLX released fixes in Diagram version 1.1.1 and PDF Export Module version 0.7.6. The vulnerabilities were responsibly reported by researchers from Pentest Limited.
Mentioned in this report
Detection guidance
Node.js Process Spawning Shell After PDF Export Request (Possible DHTMLX RCE)
Detects a Node.js process spawning a command interpreter, consistent with exploitation of DHTMLX PDF Export Module RCE (CVE-2026-41553) where injected JavaScript in the data parameter is executed server-side. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Spawning Shell Interpreter (Potential DHTMLX PDF Export RCE)
id: 6c4b099e-2398-5f38-b8c4-82fd7d338971
status: experimental
description: 'Detects a Node.js parent process spawning a shell (cmd.exe, powershell,
sh, bash) shortly after handling a request.
This pattern is consistent with exploitation of the DHTMLX PDF Export Module RCE
(CVE-2026-41553), where
attacker-supplied JavaScript in the ''data'' parameter is evaluated by Node.js and
used to execute OS commands.
'
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \node.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \bash.exe
- \sh.exe
filter:
CommandLine|contains:
- npm run
- npm install
- node_modules\.bin
condition: selection and not filter
falsepositives:
- Legitimate build/deploy scripts that invoke shell commands from a Node.js-based
CI/CD or task runner
- Developer tooling (npm scripts, gulp, webpack dev servers) that legitimately spawn
shell processes
level: high
tags:
- attack.t1059.007
- attack.t1190
author: Vorant
Node.js Process Reading Sensitive OS Files (Possible DHTMLX Path Traversal)
Detects a Node.js/PDF export process opening well-known sensitive system files, consistent with path traversal exploitation of DHTMLX Diagram/Gantt/Scheduler export modules (CVE-2026-7182, CVE-2026-41552) to disclose local server files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Process Accessing Sensitive System Files via Export Module
id: 40369705-2db9-5814-a691-7ef6a36f2371
status: experimental
description: 'Detects a Node.js process (typically backing a web export/rendering
service) reading sensitive OS configuration
files such as /etc/passwd or Windows hosts/win.ini files. This is consistent with
path traversal vulnerabilities
in DHTMLX Diagram and PDF Export modules (CVE-2026-7182, CVE-2026-41552) that allow
inclusion of local files
via an unsanitized src/data attribute in exported PDFs.
'
logsource:
category: file_event
product: linux
detection:
selection:
Image|endswith: /node
TargetFilename:
- /etc/passwd
- /etc/shadow
- /etc/hosts
- /root/.ssh/id_rsa
- /root/.bash_history
condition: selection
falsepositives:
- System monitoring or configuration management agents built on Node.js that legitimately
read these files
- Node.js based backup or log aggregation tools
level: medium
tags:
- attack.t1190
- attack.t1059.007
author: Vorant
Web Server Process Spawning Node.js with Inline Script Evaluation Flag
Detects execution of node with inline evaluation flags (-e/--eval) spawned by a web/application server process, indicating server-side injected JavaScript execution such as abuse of the DHTMLX PDF Export Module RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Inline Script Evaluation Spawned by Web Server Process
id: 97b59fd1-d8e7-52a4-a0a3-16a5c68fda65
status: experimental
description: 'Detects a Node.js process invoked with inline evaluation flags (-e or
--eval), spawned by a common
web/application server parent process. This pattern is consistent with server-side
injection of attacker
controlled JavaScript, such as exploitation of the DHTMLX PDF Export Module RCE
(CVE-2026-41553), where
the export service evaluates untrusted data instead of running a static application
script.
'
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /node
CommandLine|contains:
- '-e '
- --eval
parent_filter:
ParentImage|endswith:
- /nginx
- /apache2
- /httpd
- /node
condition: selection and parent_filter
falsepositives:
- Developers or admins manually testing inline Node.js scripts on the server for debugging
- Legitimate deployment scripts that use node -e for one-off configuration tasks
level: medium
tags:
- attack.t1059.007
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-7182
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free