Critical DLA-4427-1 2 CVEs

php-dompdf - security update

Published Dec 30, 2025 · Updated Dec 30, 2025

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	php-dompdf	0.6.2+dfsg-3.1+deb11u1

Vulnerabilities 2

Critical 9.8

CVE-2021-3838

PHAR Deserialization in dompdf/dompdf

DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to…

dompdf dompdf/dompdf dompdf/dompdf php-dompdf Debian Ubuntu Packagist

Nov 15, 2024
Medium 5.3

CVE-2022-2400

External Control of File Name or Path in dompdf/dompdf

External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.

dompdf dompdf/dompdf dompdf/dompdf icingaweb2 Debian Ubuntu Packagist

Jul 18, 2022