VORANT. Threat Intelligence Sign in Get the full feed

DHTMLX Diagram and PDF Export modules contain path traversal and RCE vulnerabilities…

critical vulnerability

DHTMLX Diagram and PDF Export modules contain path traversal and RCE vulnerabilities allowing unauthenticated attackers to read local files or execute arbitrary code.

CERT Polska coordinated disclosure of three vulnerabilities in DHTMLX software products. CVE-2026-7182 affects the Diagram export module, allowing path traversal via unsanitized src attributes to include local server files in generated PDFs. CVE-2026-41552 affects the PDF Export Module used in DHTMLX Gantt and Scheduler, enabling similar path traversal attacks through crafted HTML payloads.

The most severe vulnerability is CVE-2026-41553, a remote code execution flaw in the PDF Export Module. An unauthenticated attacker can inject malicious JavaScript into a data parameter that is processed and executed by Node.js on the server, potentially leading to full server compromise. All three vulnerabilities stem from insufficient input sanitization.

Patches are available in Diagram version 1.1.1 and PDF Export Module version 0.7.6. Organizations using DHTMLX products should prioritize updates, particularly for the RCE vulnerability which poses immediate risk to server infrastructure.

Mentioned in this report

Vulnerabilities CVE-2026-41552CVE-2026-41553CVE-2026-7182

Detection guidance

Node.js Child Process Spawned by Web Server Process (Possible PDF Export RCE)

ATT&CK T1059.007

Detects a Node.js process (typical runtime for DHTMLX PDF Export Module) spawning a shell or scripting interpreter, consistent with exploitation of CVE-2026-41553 RCE via malicious JavaScript in the data parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Spawning Shell After Possible PDF Export Exploitation
id: c493c1f0-b358-54a4-a301-82dfac9706a7
status: experimental
description: 'Detects a Node.js process spawning cmd, powershell, sh, or bash shortly
  after processing a PDF/document export request. DHTMLX PDF Export Module (CVE-2026-41553)
  allows unauthenticated attackers to inject JavaScript into the ''data'' parameter
  that is executed server-side by Node.js, potentially leading to command execution.
  Node.js server processes that normally only render documents should not spawn interactive
  shells.

  '
references:
- CERT Polska DHTMLX advisory CVE-2026-41553
author: Vorant
tags:
- attack.t1059.007
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \node.exe
    - \node
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \sh
    - \bash
    - \wscript.exe
    - \cscript.exe
  filter_common_devtools:
    CommandLine|contains:
    - npm run
    - npm install
    - node_modules\.bin
  condition: selection_parent and selection_child and not filter_common_devtools
falsepositives:
- Legitimate Node.js build/deploy tooling invoking npm scripts that spawn shells
- CI/CD pipelines running Node-based test runners that shell out
level: high

Path Traversal Attempt Against DHTMLX Diagram or PDF Export Endpoint

ATT&CK T1190

Detects HTTP requests to DHTMLX Diagram/PDF Export/Gantt/Scheduler export endpoints containing path traversal sequences in the src attribute or export payload, indicative of CVE-2026-7182 / CVE-2026-41552 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Path Traversal Sequence in DHTMLX Export Request
id: cb65b804-b166-5686-a3ea-13a08aed6c0b
status: experimental
description: 'Detects web requests to DHTMLX Diagram, Gantt or Scheduler export/PDF
  endpoints where the request body or URL contains directory traversal sequences (e.g.
  ../) inside an src attribute or export data parameter. This matches CVE-2026-7182
  and CVE-2026-41552 path traversal vulnerabilities that allow local file inclusion
  into generated PDFs.

  '
references:
- CERT Polska DHTMLX advisory CVE-2026-7182 CVE-2026-41552
author: Vorant
tags:
- attack.t1190
- attack.t1083
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - export
    - pdf
    - gantt
    - scheduler
    - diagram
  selection_traversal:
  - cs-uri-query|contains:
    - ../
    - ..%2f
    - ..\\
  - c-uri-body|contains:
    - ../
    - ..%2f
    - src=
  condition: selection_endpoint and selection_traversal
falsepositives:
- Legitimate relative file references in diagram export data that happen to contain
  double dots (rare)
- Security scanners/pentest tools probing the endpoint intentionally
level: medium

Node.js Process Reading Sensitive Local Files After Export Request

ATT&CK T1083

Detects a Node.js-based export service process opening or reading sensitive system files (e.g. /etc/passwd, win.ini, SAM hive paths) shortly after handling an export/diagram request, consistent with path traversal file inclusion in DHTMLX export modules. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node Export Process Accessing Sensitive OS Files
id: e0038d2e-593e-5b6f-80fd-84935383107b
status: experimental
description: 'Detects a Node.js process associated with a document/diagram export
  service opening well-known sensitive files outside its expected working directory
  (e.g. /etc/passwd, /etc/shadow, C:\Windows\win.ini, boot.ini). This behaviour is
  consistent with exploitation of DHTMLX Diagram/PDF Export path traversal vulnerabilities
  (CVE-2026-7182, CVE-2026-41552) used for local file inclusion/discovery.

  '
references:
- CERT Polska DHTMLX advisory CVE-2026-7182 CVE-2026-41552
author: Vorant
tags:
- attack.t1083
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \node.exe
    - \node
  selection_target:
    TargetFilename|contains:
    - win.ini
    - boot.ini
    - \Windows\System32\config\SAM
    - /etc/passwd
    - /etc/shadow
  condition: selection_process and selection_target
falsepositives:
- Legitimate diagnostic or backup tooling implemented in Node.js reading these files
- System monitoring agents built on Node.js runtime
level: high

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-7182

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free