526 matches found
Path Traversal
dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths when processing SVG images embedded through data: URIs, where the second SVG processing pass performed by php-svg-lib does not enforce the same security restrictions, allowing an...
File Existence Oracle
dompdf/dompdf is vulnerable to File Existence Oracle. The vulnerability is due to inconsistent handling of the CSS @font-face directive when processing local file:// resources, which allows an attacker to repeatedly reference local files and observe differences in memory exhaustion behavior to...
Uncontrolled Resource Consumption
dompdf/dompdf is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the library trusting attacker-controlled BMP header dimensions without validating the image size before conversion, which allows an attacker to embed a crafted BMP image e.g., via a data:image/bmp;base64...
CVE-2026-59943
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...
CVE-2026-59941
creationtimestamp| type| source ---|---|--- 2026-07-23 00:35:10+00:00| published-proof-of-concept| https://github.com/dompdf/dompdf/security/advisories/GHSA-8hg6-c449-896m 2026-08-02 18:00:05+00:00| published-proof-of-concept| Telegram/SHCtA7dY1mItB2gbm66yqWXF69tJGblulI8ccELNE-1shwc 2026-08-03...
CVE-2026-59942
creationtimestamp| type| source ---|---|--- 2026-07-23 00:35:07+00:00| published-proof-of-concept| https://github.com/dompdf/dompdf/security/advisories/GHSA-f5gf-2cj8-52g2...
CVE-2026-59943
creationtimestamp| type| source ---|---|--- 2026-07-23 00:35:05+00:00| published-proof-of-concept| https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297...
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Details Using an element inside a data-URI...
GHSA-J8QW-6JW8-R297 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Details Using an element inside a data-URI...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the processing of embedded SVG images containing elements with xlink:href attributes referencing local files or directories. An attacker can determine the existence of files or directories on the server by...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the render process. An attacker can exhaust system resources and cause the PHP process to crash by submitting a specially crafted HTML document containing a high-entropy,...
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...
GHSA-F5GF-2CJ8-52G2 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS via the imagecreatefrombmp process. An attacker can cause excessive memory and CPU consumption by submitting a specially crafted BMP image with large declared dimensions embedded as a data URI in HTML. This can lea...
GHSA-8HG6-C449-896M Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...
CVE-2026-55554
creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:26+00:00| published-proof-of-concept| https://github.com/dompdf/dompdf/security/advisories/GHSA-wvh6-f5jh-8gw4...
CVE-2026-56722
creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:19+00:00| published-proof-of-concept| https://github.com/dompdf/dompdf/security/advisories/GHSA-cx96-42px-69fm...
GHSA-CX96-42PX-69FM Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnik...
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnik...