UBUNTU-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

Linux Distros Unpatched Vulnerability : CVE-2026-55554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after...

DEBIAN-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554 Dompdf: Chroot Validation Bypass

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554 Dompdf: Chroot Validation Bypass

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554

Summary of CVE-2026-55554 (Dompdf) : Dompdf (PHP HTML-to-PDF converter) versions up to 3.15 are affected by a chroot validation bypass in validateLocalUri(), which uses a realpath-normalized prefix check with strpos. Because the trailing slash is removed during normalization, the chroot path is o...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

Path Traversal

dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to an improper prefix validation in the validateLocalUri method, where normalized paths are checked using strpos without enforcing directory boundaries, which allows an attacker who can control rendered HTML to escape the...

File Existence Oracle

dompdf/dompdf is vulnerable to File Existence Oracle. The vulnerability is due to inconsistent handling of the CSS @font-face directive when processing local file:// resources, which allows an attacker to repeatedly reference local files and observe differences in memory exhaustion behavior to...

GHSA-CX96-42PX-69FM Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnik...

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnik...

GHSA-WVH6-F5JH-8GW4 Dompdf: Chroot Validation Bypass

Summary The chroot check for local files uses a prefix string check to enforce chroot boundaries. The simple string comparison it performs allows paths like /var/www/rootsecret/file.html when chroot is /var/www/root. This allows attacker-controlled document paths/resources to bypass intended loca...

Dompdf: Chroot Validation Bypass

Summary The chroot check for local files uses a prefix string check to enforce chroot boundaries. The simple string comparison it performs allows paths like /var/www/rootsecret/file.html when chroot is /var/www/root. This allows attacker-controlled document paths/resources to bypass intended loca...

PT-2026-63542

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description An issue exists in the validateLocalUri method where chroot boundaries are enforced using a strpos prefix check after paths are normalized with realpath. Because normalization removes the trailing...

SUSE CVE-2026-44507

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43617. Reason: This candidate is a duplicate of CVE-2026-43617. Notes: All CVE users should reference CVE-2026-43617 instead of this candidate...

SUSE CVE-2026-44509

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate...

CVE-2026-44509

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate...

DEBIAN-CVE-2026-44509

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open calls missed races in other path based system calls like chmod and chown. For rsync daemons with "use chroot = no" this...

CVE-2026-44507

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43617. Reason: This candidate is a duplicate of CVE-2026-43617. Notes: All CVE users should reference CVE-2026-43617 instead of this candidate...