DDI CENTRAL · CVE-2026-12574 · Vendor
FIX → build 6201 ✓ verified
DDI Central 6.2.0 (build 6200 and below) does not escape user-supplied values in analytics report templates. A logged-in operator-level user can inject HTML/JavaScript that the PDF renderer runs, which can disclose local files from the server. Fixed in build 6201.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted ManageEngine DDI Central at build 6200 (6.2.0) or below. The attacker needs a valid operator-level account, so exposure is mainly through compromised or untrusted operators. Teams not running DDI Central, or already on build 6201 or later, can skip it.
Not affected if auth-required, unknown
Who cares ddi-central, manageengine, self-hosted
Upgrade to build 6201
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Apply the build 6201 service pack to the DDI Central Console and Node Agent instances (vendor: escapes values in report templates and restricts local file access in the PDF renderer).