The vulnerability is a path traversal flaw in DHTMLX Diagram’s export module. Because the component does not sanitize the src attribute in the generated HTML, an unauthenticated user can embed a reference to a local file in a crafted payload. When the diagram is exported to PDF, the engine loads that file and embeds its contents into the resulting PDF, enabling disclosure of arbitrary files from the server.

Affected product is DHTMLX:Diagram. Versions prior to 1.1.1 are vulnerable. The problem was fixed in 1.1.1.

With a CVSS score of 9.2, the vulnerability poses a serious risk. The attack vector is likely file inclusion through the web interface that offers the export feature, and no authentication is required, so any visitor can exploit it. EPSS score is not available, but the high CVSS and lack of mitigation suggest that exploitation could be attempted quickly. The vulnerability is not currently listed in CISA KEV, but its severity warrants immediate attention.