CVEvulnerability

CVE-2026-7182

9.2 CRITICAL Published 2026-05-15 Modified 2026-10-26 Official page ↗

Status: Awaiting Analysis
Published: 2026-05-15
Last modified: 2026-10-26
Assigner: [email protected]
CVSS 4.0 ([email protected]): 9.2 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses: CWE-22

Description

Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include local files from the server and display them in the generated pdf. This issue was fixed in version 1.1.1.

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References

https://cert.pl/en/posts/2026/05/CVE-2026-7182 cert.pl
https://dhtmlx.com/docs/products/dhtmlxDiagram/ dhtmlx.com
https://docs.dhtmlx.com/diagram/whats_new/#version-612 docs.dhtmlx.com

CVE-2026-7182

Description

Related

Weakness · CWE (1)

References