Vulnerabilities

TI-2026-30115 CVE-2026-41553 · GHSA-qc73-55rc-fgph

Remote Code Execution in PDF Export Module

MEDIUM 50

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00648 Published 2026-05-15 Fixed in 0.7.6 CWE-78

TI-2026-30114 CVE-2026-41552 · GHSA-cj88-m5vv-89m3

Path Traversal in PDF Export Module

MEDIUM 46

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00497 Published 2026-05-15 Fixed in 0.7.6 CWE-22

TI-2026-06303 CVE-2026-7182 · GHSA-hr7c-pw36-w99g

Path Traversal in Diagram

MEDIUM 46

Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00397 Published 2026-05-15 Fixed in 1.1.1 CWE-22

TI-2024-36799 CVE-2024-55214 · GHSA-42h6-4vvm-4f49

Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker…

MEDIUM 62

Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00549 Published 2025-02-07 No fix listed CWE-22

TI-2024-36798 CVE-2024-55213 · GHSA-jrp8-vq3h-w34w

Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker…

MEDIUM 62

Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00753 Published 2025-02-07 No fix listed CWE-22

TI-2013-05263 CVE-2013-6281 · GHSA-9qqw-5936-v8mm

Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet…

LOW 28

Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "page" parameter…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0522 Published 2013-10-25 No fix listed CWE-79