CVE-2022-28368

Dompdf 1.2.1 is vulnerable to remote code execution through a .php file placed in the src:url field of an @font-face CSS rule within an HTML input. The issue arises in the cached font handling, allowing an attacker to execute arbitrary PHP when the font cache is processed. Multiple public referen...

CVE-2023-24813

Dompdf (PHP HTML‑to‑PDF) has two CVEs (CVE-2023-23924 and CVE-2023-24813) related to SVG parsing. The root cause is inconsistent attribute parsing between Dompdf and php-svg-lib: Dompdf considers xlink:href when present, but php-svg-lib also reads href, allowing an empty xlink:href to bypass prot...

CVE-2021-3838

CVE-2021-3838 affects php-dompdf (before 2.0.0). The flaw stems from PHAR deserialization due to insufficient protocol checking when passing input to file_get_contents(), allowing an attacker who can upload arbitrary files to trigger deserialization via phar:// and potentially achieve remote code...

CVE-2014-5013

CVE-2014-5013 affects Dompdf prior to 0.6.2 and allows remote code execution; the issue is linked to CVE-2014-2383. The related advisories indicate a security-focused 0.6.2 release that addresses multiple vulnerabilities in dompdf (including RCE and information-disclosure issues) and recommends u...

CVE-2014-5011

CVE-2014-5011 affects Dompdf prior to 0.6.2. The vulnerability arises from improper handling/validation of untrusted input when processing HTML content, enabling information disclosure. Impact is limited to affected Dompdf versions; remediation is upgrading to Dompdf 0.6.2 or later as indicated b...

CVE-2022-0085

CVE-2022-0085 describes a Server-Side Request Forgery (SSRF) in the GitHub repository dompdf/dompdf affecting versions before 2.0.0. The connected documents confirm the issue is an SSRF vulnerability in dompdf/dompdf and indicate the affected scope is pre-2.0.0. No exploit details, attack vectors...

CVE-2023-23924

Dompdf 2.0.1 is vulnerable to URI validation bypass during SVG parsing. If an attacker provides an SVG containing an tag with uppercase letters, the parser may bypass protection and allow arbitrary URL calls via the phar wrapper. In PHP

CVE-2014-5012

CVE-2014-5012 affects Dompdf up to version 0.6.2; faulty input handling allows denial of service during HTML-to-PDF processing. The provided documents confirm the vulnerability and a fix in v0.6.2 (GitHub release tag). No exploitation context or in-the-wild details are provided in the connected d...

CVE-2022-41343

CVE-2022-41343 affects Dompdf before 2.0.1, where registerFont in FontMetrics.php allows remote file inclusion because URI validation fails to stop font registration. Exploit PoCs and Python scripts/staged reverse-shell demos exist (e.g., via @font-face). Impact is remote access to font assets po...

CVE-2022-2400

CVE-2022-2400 affects php-dompdf prior to 2.0.0, with Debian/Ubuntu advisories (DLA-4427-1, USN-6277-1/2) documenting a vulnerability where external control of the file name/path could bypass access checks. Debian 11 fix: upgrade to 0.6.2+dfsg-3.1+deb11u1; Ubuntu advisories reference correspondin...

CVE-2021-3902

CVE-2021-3902 describes an XXE flaw in dompdf/dompdf's SVG parser (improper restriction of external entities) that enables SSRF and PHAR deserialization attacks. Affected: dompdf/dompdf prior to version 2.0.0. Exploitation possible even when isRemoteEnabled is false. Consequences include SSRF, di...

CVE-2023-50262

Dompdf (PHP HTML-to-PDF) is vulnerable to a DoS via infinite recursion when parsing chained SVG references. Prior to version 2.0.4, self-references are checked, but chained references between two or more SVG images are not validated, which can exhaust memory or processing time on affected systems...

CVE-2026-55555

Summary (concrete details from provided docs): Dompdf (PHP HTML-to-PDF converter) versions 3.15 and earlier are vulnerable to a File Existence Oracle via the CSS @font-face directive. An attacker can supply HTML that references local files with the file:// protocol to cause memory exhaustion, exp...

CVE-2026-55554

CVE-2026-55554 affects Dompdf (PHP HTML-to-PDF converter). The issue stems from validateLocalUri() using a realpath()-based normalization and a prefix strpos() check to enforce chroot boundaries. Because trailing directory separators are stripped during normalization, a defined chroot like /var/w...

CVE-2026-56722

Dompdf (PHP HTML-to-PDF library) prior to v3.16 is vulnerable to local-file read via SVG in a data: URI. The attack wraps a local file path in an SVG image; dompdf processes the SVG twice, and the second pass hands the image to php-svg-lib with external references enabled. php-svg-lib then reads ...

CVE-2026-59941

CVE-2026-59941 (Dompdf) affects Dompdf (PHP HTML-to-PDF converter) up through version 3.15. The root cause is that a BMP image’s declared width/height in the header is trusted, leading to allocation of a full GD canvas (e.g., 6000×6000) even if pixel data is minimal. This enables a lightweight 16...

CVE-2026-59942

CVE-2026-59942 affects Dompdf (PHP HTML-to-PDF converter). Multiple connected sources describe that versions 3.15 and earlier are vulnerable to a Denial of Service caused by resource exhaustion when processing an HTML document containing a single, very large image (e.g., 30,000×30,000). The vulne...

CVE-2026-59943

Dompdf vulnerability (CVE-2026-59943) affects version 3.15 and earlier. In a data-URI encoded SVG, using an element with href/xlink:href pointing to local files (e.g., file:///...), the rendering process can leak filesystem information by differentiating behavior when a referenced file/directory...