Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE. A lack of sanitization/check in the font path returned by php-svg-lib, in the case of inline CSS font defined, allows triggering metadata unserializing on PHP < 8.0. The problem lies on the openFont function of the lib/Cpdf.php library, when the $font variable passed by php-svg-lib isn't checked correctly