11 results · Feed
-
Medium 6.3CVE-2026-59941 Public exploit
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whos…
-
Medium 6.3
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with…
-
Medium 6.3
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using…
-
Medium 6.3
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG …
-
Low 2.3
Dompdf: Chroot Validation Bypass
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separa…
-
Low 2.3
Dompdf: File existence oracle via font-face stylesheet declaration
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol rep…
-
Critical 9.8
PHAR Deserialization in dompdf/dompdf
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to…
-
Medium 5.3
External Control of File Name or Path in dompdf/dompdf
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
-
Medium 6.5
DOMPDF Information Disclosure
DOMPDF before 0.6.2 allows Information Disclosure.
-
Medium 6.5
DOMPDF denial of service vulnerability
DOMPDF before 0.6.2 allows denial of service.
-
High 8.8
DOMPDF Remote Code Execution
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.