The PDF Export Module used in DHTMLX Gantt and Scheduler products suffers from a path traversal flaw due to missing HTML sanitization. An attacker who can submit an HTML payload to the PDF export interface can embed references to arbitrary local files. When the module renders the PDF those file contents are embedded and served to the attacker, exposing server files and potentially containing sensitive configuration or credentials. The weakness aligns with CWE‑22, indicating untrusted path traversal without proper validation.

The issue affects all versions of DHTMLX’s PDF Export Module prior to 0.7.6, which is employed within the Gantt and Scheduler components. The only version that has the fix is 0.7.6; earlier releases remain vulnerable.

With a CVSS score of 9.2 the vulnerability is deemed critical. The lack of authentication on the PDF export endpoint means an attacker can trigger the flaw from any external source, and the path traversal can reach arbitrary files on the server. Although the EPSS score is not available, the high severity and absence of a known exploitation payload in public advisories suggests the likelihood of exploitation remains significant. The vulnerability is not listed in the CISA KEV catalog.