Arbitrary Code Execution

2023-02-1007:49:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

dompdf

cache.php

arbitrary code execution

svg files

php-svg-lib

url parsing

EPSS

0.005

Percentile

75.6%

JSON

dompdf/dompdf is vulnerable to Arbitrary Code Execution. The vulnerability exists in Cache.php due to a lack of validations for SVG files in Dompdf and php-svg-lib, allowing an attacker to parse an arbitrary URL with arbitrary protocols, which can resulting in Arbitrary Code Execution.