Skip to content
OpenAdvisories
Critical DLA-3495-2 1 CVE

php-dompdf - regression update

Published Aug 10, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 php-dompdf 0.6.2+dfsg-3+deb10u2

Vulnerabilities 1

  • Critical 9.8
    CVE-2021-3838

    PHAR Deserialization in dompdf/dompdf

    DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to…

    dompdf dompdf/dompdf dompdf/dompdf php-dompdf Debian Ubuntu Packagist