---
id: "CVE-2026-12574"
page: "https://infrastack.ai/live/CVE-2026-12574"
kind: "vulnerability"
aliases: ["CVE-2026-12574"]
title: "ManageEngine DDI Central: operator-level user can read local files through analytics PDF generation"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "DDI Central", "fixed": ["build 6201"], "affected": "<= build 6200 (6.2.0)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ddi-central", "manageengine", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "unknown"]
published_at: "2026-11-10T12:17:19+00:00"
first_seen_at: "2026-11-10T12:21:54+00:00"
updated_at: "2026-11-10T12:24:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12574", "first_seen_at": "2026-11-10T12:21:54+00:00"}, {"source": "analyst", "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html", "first_seen_at": "2026-11-10T12:24:17+00:00", "cites": ["https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12574"]}]
exploit_sources: []
---

# ManageEngine DDI Central: operator-level user can read local files through analytics PDF generation

Link for people: https://infrastack.ai/live/CVE-2026-12574 (this .md is for agents)

DDI Central 6.2.0 (build 6200 and below) does not escape user-supplied values in analytics report templates. A logged-in operator-level user can inject HTML/JavaScript that the PDF renderer runs, which can disclose local files from the server. Fixed in build 6201.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DDI Central affected <= build 6200 (6.2.0) fixed build 6201

## How to check

In the DDI Central console, check the build number (About / Read Me). Build 6200 or below is affected; 6201 or later is fixed. Also check Node Agent instances.

## Fix

Apply the build 6201 service pack to the DDI Central Console and Node Agent instances (vendor: escapes values in report templates and restricts local file access in the PDF renderer).

## Timeline

- 2026-11-10T12:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12574
- 2026-11-10T12:24:17+00:00 analyst https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html — Read ManageEngine advisory: fixed in build 6201 (Jun 18 2026), requires operator-level login; no exploitation or PoC seen.

## Documents

- [advisory] ManageEngine DDI Central: CVE-2026-12574 security update https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12574.html
- [mentions] NVD CVE-2026-12574 https://nvd.nist.gov/vuln/detail/CVE-2026-12574

## From the sources

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_