CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

CVE-2026-55555

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...

CVE-2026-55555 Dompdf: File existence oracle via font-face stylesheet declaration

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...

CVE-2026-55555 Dompdf: File existence oracle via font-face stylesheet declaration

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...

CVE-2026-55555

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...

CVE-2026-55555

Summary (concrete details from provided docs): Dompdf (PHP HTML-to-PDF converter) versions 3.15 and earlier are vulnerable to a File Existence Oracle via the CSS @font-face directive. An attacker can supply HTML that references local files with the file:// protocol to cause memory exhaustion, exp...

File Existence Oracle

dompdf/dompdf is vulnerable to File Existence Oracle. The vulnerability is due to inconsistent handling of the CSS @font-face directive when processing local file:// resources, which allows an attacker to repeatedly reference local files and observe differences in memory exhaustion behavior to...

CVE-2026-65712

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

CVE-2026-65712 Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

CVE-2026-65712 Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

EUVD-2026-47912

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

CVE-2026-65712

CVE-2026-65712 concerns Joomla Extension - regularlabs.com, specifically the Joomla Pro CDN feature. The issue is insecure path handling in the CDN versioning system, which could check file paths outside the site directory, potentially exposing local file existence and modification metadata. The ...

CVE-2026-65712

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

PT-2026-63609

CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

Dompdf: File existence oracle via font-face stylesheet declaration

Description Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw ...

GHSA-7X2P-4JVH-6384 Dompdf: File existence oracle via font-face stylesheet declaration

Description Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw ...

CVE-2026-46671 Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads ent...

Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

Summary An authenticated path traversal in assets/icon allows local SVG file read by passing traversal sequences in the extension parameter. The issue is caused by file existence checks happening before extension validation. Details The endpoint: - src/controllers/AssetsController.php:1115-1123 -...

GHSA-C43V-4CR8-6MVP Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

Summary An authenticated path traversal in assets/icon allows local SVG file read by passing traversal sequences in the extension parameter. The issue is caused by file existence checks happening before extension validation. Details The endpoint: - src/controllers/AssetsController.php:1115-1123 -...

CVE-2026-53422

Observable Response Discrepancy vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSHFXPREALPATH handler in sshsftpd calls relatefilename/3 with Canonicalize=false, unlik...