Dompdf: File existence oracle via font-face stylesheet declaration

Description Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw ...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the processing of CSS @font-face directives referencing local files via the file:// protocol. An attacker can determine the existence of sensitive files on the server by submitting crafted HTML and analyzing the...

GHSA-WVH6-F5JH-8GW4 Dompdf: Chroot Validation Bypass

Summary The chroot check for local files uses a prefix string check to enforce chroot boundaries. The simple string comparison it performs allows paths like /var/www/rootsecret/file.html when chroot is /var/www/root. This allows attacker-controlled document paths/resources to bypass intended loca...

Dompdf: Chroot Validation Bypass

Summary The chroot check for local files uses a prefix string check to enforce chroot boundaries. The simple string comparison it performs allows paths like /var/www/rootsecret/file.html when chroot is /var/www/root. This allows attacker-controlled document paths/resources to bypass intended loca...

PT-2026-63555

Name of the Vulnerable Software and Affected Versions Dompdf versions 3.x and earlier Description An issue exists where a malicious actor providing unrestricted content for rendering can leak filesystem information. By using an element within a data-URI encoded SVG document, an attacker can attem...

PT-2026-63554

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf is susceptible to a Denial of Service DoS attack via resource exhaustion. An unauthenticated remote attacker can crash the PHP process by submitting a specially crafted HTML document containing ...

PT-2026-63542

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description An issue exists in the validateLocalUri method where chroot boundaries are enforced using a strpos prefix check after paths are normalized with realpath. Because normalization removes the trailing...

PT-2026-63553

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf fails to validate the dimensions of BMP images before processing them. The software relies solely on the declared header dimensions to allocate memory for the image canvas via the...

Dompdf RCE via Malicious Font Caching (CVE-2022-28368)

This module exploits CVE-2022-28368, a Remote Code Execution vulnerability in dompdf versions prior to 1.2.1. The vulnerability exists because dompdf preserves the original file extension when caching fonts downloaded via CSS @font-face rules. By pointing a @font-face src to a .php file containin...

📄 dompdf Remote Code Execution

This Metasploit module exploits CVE-2022-28368, a remote code execution vulnerability in dompdf versions prior to 1.2.1. The vulnerability exists because dompdf preserves the original file extension when caching fonts downloaded via CSS @font-face rules. By pointing a @font-face src to a .php fil...

EUVD-2026-28921

A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made...

CVE-2026-8193

A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made...

CVE-2026-8193

CVE-2026-8193 affects Akaunting 3.1.21, specifically the Invoice PDF Rendering component’s dompdf.php file. The vulnerability arises from unknown processing in that file, enabling a remote attacker to manipulate inputs to achieve server-side request forgery (SSRF). Exploitation is indicated as po...

CVE-2026-8193

A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made...

CVE-2026-8193 Akaunting Invoice PDF Rendering dompdf.php server-side request forgery

A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made...

PT-2026-39405

A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made...

Akaunting 代码问题漏洞

Akaunting is an application software developed by Akaunting Company that provides all the tools needed for online fund management. Version 3.1.21 of Akaunting has a code vulnerability; this vulnerability stems from an unknown processing in the Invoice PDF Rendering component’s config/dompdf.php...

CVE-2026-34367

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery SSRF vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field i...

CVE-2026-34366

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery SSRF vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes...

CVE-2026-34366

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery SSRF vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes...