Dhtmlx vulnerabilities
We track 3 vulnerabilities in Dhtmlx products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 15, 2026.
Latest Dhtmlx vulnerabilities
- 9.2 Critical severity
Diagram: Improper Limitation of a Pathname to a Restricted Directory
Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue wa
- 10.0 Critical severity
PDF Export Module: Improper Neutralization of Special Elements used in an OS Command
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed
- 7.5 High severity
PDF Export Module: Improper Limitation of a Pathname to a Restricted Directory
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the gener