CVE-2026-56722

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-59941 Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

CVE-2026-59941 Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

EUVD-2026-50061

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

EUVD-2026-50027

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-59943: Generation of Error Message Containing Sensitive Information

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

GHSA-9XWG-3R6F-JCX2 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...

Uncontrolled Resource Consumption

dompdf/dompdf is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the library trusting attacker-controlled BMP header dimensions without validating the image size before conversion, which allows an attacker to embed a crafted BMP image e.g., via a data:image/bmp;base64...

GHSA-J8QW-6JW8-R297 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Details Using an element inside a data-URI...

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Details Using an element inside a data-URI...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the imagecreatefrombmp process. An attacker can cause excessive memory and CPU consumption by submitting a specially crafted BMP image with large declared dimensions embedded as a data URI in HTML. This can lea...

GHSA-8HG6-C449-896M Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnik...

PT-2026-63555

Name of the Vulnerable Software and Affected Versions Dompdf versions 3.x and earlier Description An issue exists where a malicious actor providing unrestricted content for rendering can leak filesystem information. By using an element within a data-URI encoded SVG document, an attacker can attem...

PT-2026-63553

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf fails to validate the dimensions of BMP images before processing them. The software relies solely on the declared header dimensions to allocate memory for the image canvas via the...