{"id":"CVE-2026-12574","kind":"vulnerability","aliases":["CVE-2026-12574"],"related":[],"title":"ManageEngine DDI Central: operator-level user can read local files through analytics PDF generation","description":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.","summary":"DDI Central 6.2.0 (build 6200 and below) does not escape user-supplied values in analytics report templates. A logged-in operator-level user can inject HTML/JavaScript that the PDF renderer runs, which can disclose local files from the server. Fixed in build 6201.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DDI Central","fixed":["build 6201"],"affected":"<= build 6200 (6.2.0)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ddi-central","manageengine","self-hosted","vendor"],"not_affected_if":["auth-required","unknown"],"how_to_check":"In the DDI Central console, check the build number (About / Read Me). Build 6200 or below is affected; 6201 or later is fixed. Also check Node Agent instances.","fix":"Apply the build 6201 service pack to the DDI Central Console and Node Agent instances (vendor: escapes values in report templates and restricts local file access in the PDF renderer).","status":"open","published_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:33+00:00","updated_at":"2026-11-10T12:24:17+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T12:22:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"ManageEngine DDI Central: PDF generation flaw leaks local files","impact":"medium","summary":"ManageEngine DDI Central versions 6200 and below let injected HTML and JavaScript reach the server-side analytics PDF generator. An attacker can use this to read local files on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","ddi-central","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads local files on the DDI Central server","analyst_note":"Confirm the fixed version and whether authentication is required via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-12574 and the Zoho advisory.","how_to_check":"- Check the installed DDI Central version against the affected range (6200 and below).\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running ManageEngine DDI Central 6200 or earlier that generate analytics PDF reports. Exposure depends on whether users can supply content that reaches the PDF generator. Sources do not say which deployments are reachable from outside.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4531,"output_tokens":487,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether authentication is required via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-12574 and the Zoho advisory.","search":"'-12574':18A,21A '-2026':17A,20A '6.2.0':34B '6200':36B,84C '6201':77B 'analyt':13A,47B,96C 'build':35B,76B 'central':3A,23A,26B,33B,82C 'corpor':79C 'cve':16A,19A 'ddi':2A,22A,25B,32B,81C 'ddi-centr':24B 'disclos':68B 'disclosur':103C 'escap':41B 'file':11A,70B,102C 'fix':74B 'generat':15A,98C 'host':30B 'html/javascript':60B,93C 'inject':59B,94C 'lead':99C 'level':6A,56B 'local':10A,69B,101C 'log':52B 'logged-in':51B 'manageengin':1A,27B,80C 'oper':5A,55B 'operator-level':4A,54B 'pdf':14A,63B,97C 'read':9A 'render':64B 'report':48B 'run':65B 'self':29B 'self-host':28B 'server':73B,91C 'server-sid':90C 'side':92C 'suppli':44B 'templat':49B 'user':7A,43B,57B 'user-suppli':42B 'valu':45B 'vendor':31B 'version':83C 'vulner':88C 'zoho':78C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted ManageEngine DDI Central at build 6200 (6.2.0) or below. The attacker needs a valid operator-level account, so exposure is mainly through compromised or untrusted operators. Teams not running DDI Central, or already on build 6201 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T12:24:17Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html","run_id":2448},"products":{"at":"2026-11-10T12:24:17Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html","run_id":2448},"how_to_check":{"at":"2026-11-10T12:24:17Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html","run_id":2448},"who_affected":{"at":"2026-11-10T12:24:17Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html","run_id":2448}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["central","ddicentral"],"ptokens":["central","ddi"],"labels":["ddicentral","high","manageengine","selfhosted","vendor"],"campaign_type":null,"search_a":"'-12574':18A,21A '-2026':17A,20A 'analyt':13A 'central':3A,23A 'cve':16A,19A 'ddi':2A,22A 'file':11A 'generat':15A 'level':6A 'local':10A 'manageengin':1A 'oper':5A 'operator-level':4A 'pdf':14A 'read':9A 'user':7A","search_b":"'6.2.0':34B '6200':36B '6201':77B 'analyt':47B 'build':35B,76B 'central':26B,33B 'ddi':25B,32B 'ddi-centr':24B 'disclos':68B 'escap':41B 'file':70B 'fix':74B 'host':30B 'html/javascript':60B 'inject':59B 'level':56B 'local':69B 'log':52B 'logged-in':51B 'manageengin':27B 'oper':55B 'operator-level':54B 'pdf':63B 'render':64B 'report':48B 'run':65B 'self':29B 'self-host':28B 'server':73B 'suppli':44B 'templat':49B 'user':43B,57B 'user-suppli':42B 'valu':45B 'vendor':31B","search_c":"'6200':84C 'analyt':96C 'central':82C 'corpor':79C 'ddi':81C 'disclosur':103C 'file':102C 'generat':98C 'html/javascript':93C 'inject':94C 'lead':99C 'local':101C 'manageengin':80C 'pdf':97C 'server':91C 'server-sid':90C 'side':92C 'version':83C 'vulner':88C 'zoho':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12574","severity":null,"published_at":"2026-11-10T12:17:19+00:00","modified_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-12574:2448","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html","severity":null,"published_at":"2026-11-10T12:24:17+00:00","modified_at":"2026-11-10T12:24:17+00:00","first_seen_at":"2026-11-10T12:24:17+00:00","fetched_at":"2026-11-10T12:24:17+00:00","note":"Read ManageEngine advisory: fixed in build 6201 (Jun 18 2026), requires operator-level login; no exploitation or PoC seen.","cites":["https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html","https://nvd.nist.gov/vuln/detail/CVE-2026-12574"]}],"documents":[{"id":114947,"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html","title":"ManageEngine DDI Central: CVE-2026-12574 security update","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114948,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12574","title":"NVD CVE-2026-12574","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}