DHTMLX Diagram patches path traversal and code execution flaws
DHTMLX Diagram and PDF Export modules contain path traversal and RCE vulnerabilities allowing unauthenticated attackers to read local files or execute arbitrary code.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of three vulnerabilities in DHTMLX software products. CVE-2026-7182 affects the Diagram export module, allowing path traversal via unsanitized src attributes to include local server files in generated PDFs. CVE-2026-41552 affects the PDF Export Module used in DHTMLX Gantt and Scheduler, enabling similar path traversal attacks through crafted HTML payloads.
The most severe vulnerability is CVE-2026-41553, a remote code execution flaw in the PDF Export Module. An unauthenticated attacker can inject malicious JavaScript into a data parameter that is processed and executed by Node.js on the server, potentially leading to full server compromise. All three vulnerabilities stem from insufficient input sanitization.
Patches are available in Diagram version 1.1.1 and PDF Export Module version 0.7.6. Organizations using DHTMLX products should prioritize updates, particularly for the RCE vulnerability which poses immediate risk to server infrastructure.
Mentioned in this report
Detection guidance
Node.js Child Process Spawned by Web Server Process (Possible PDF Export RCE)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Node.js process (typical runtime for DHTMLX PDF Export Module) spawning a shell or scripting interpreter, consistent with exploitation of CVE-2026-41553 RCE via malicious JavaScript in the data parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Spawning Shell After Possible PDF Export Exploitation
id: c493c1f0-b358-54a4-a301-82dfac9706a7
status: experimental
description: 'Detects a Node.js process spawning cmd, powershell, sh, or bash shortly
after processing a PDF/document export request. DHTMLX PDF Export Module (CVE-2026-41553)
allows unauthenticated attackers to inject JavaScript into the ''data'' parameter
that is executed server-side by Node.js, potentially leading to command execution.
Node.js server processes that normally only render documents should not spawn interactive
shells.
'
references:
- CERT Polska DHTMLX advisory CVE-2026-41553
author: Vorant
tags:
- attack.t1059.007
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \node.exe
- \node
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \sh
- \bash
- \wscript.exe
- \cscript.exe
filter_common_devtools:
CommandLine|contains:
- npm run
- npm install
- node_modules\.bin
condition: selection_parent and selection_child and not filter_common_devtools
falsepositives:
- Legitimate Node.js build/deploy tooling invoking npm scripts that spawn shells
- CI/CD pipelines running Node-based test runners that shell out
level: high
Node.js Process Reading Sensitive Local Files After Export Request
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Node.js-based export service process opening or reading sensitive system files (e.g. /etc/passwd, win.ini, SAM hive paths) shortly after handling an export/diagram request, consistent with path traversal file inclusion in DHTMLX export modules. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node Export Process Accessing Sensitive OS Files
id: e0038d2e-593e-5b6f-80fd-84935383107b
status: experimental
description: 'Detects a Node.js process associated with a document/diagram export
service opening well-known sensitive files outside its expected working directory
(e.g. /etc/passwd, /etc/shadow, C:\Windows\win.ini, boot.ini). This behaviour is
consistent with exploitation of DHTMLX Diagram/PDF Export path traversal vulnerabilities
(CVE-2026-7182, CVE-2026-41552) used for local file inclusion/discovery.
'
references:
- CERT Polska DHTMLX advisory CVE-2026-7182 CVE-2026-41552
author: Vorant
tags:
- attack.t1083
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection_process:
Image|endswith:
- \node.exe
- \node
selection_target:
TargetFilename|contains:
- win.ini
- boot.ini
- \Windows\System32\config\SAM
- /etc/passwd
- /etc/shadow
condition: selection_process and selection_target
falsepositives:
- Legitimate diagnostic or backup tooling implemented in Node.js reading these files
- System monitoring agents built on Node.js runtime
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-7182
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs