Dompdf: Four Vulnerabilities Disclosed Together Affecting Versions 3.15 and Prior
Four vulnerabilities in Dompdf versions 3.15 and prior were disclosed on July 29, 2026, impacting its ability to securely convert HTML to PDF.
Key findings
- Four vulnerabilities disclosed on July 29, 2026, affect Dompdf versions 3.15 and prior.
- Vulnerabilities include directory traversal, filesystem information leak via SVG, File Existence Oracle, and image processing flaws.
- All four CVEs were patched in Dompdf version 3.16.
- Users should update to version 3.16 or later to mitigate these security risks.
On July 29, 2026, a batch of four vulnerabilities was disclosed for Dompdf, an HTML to PDF converter for PHP. All vulnerabilities affect versions 3.15 and prior, and were patched in version 3.16. The disclosures highlight potential security risks when processing untrusted HTML content.
One vulnerability, CVE-2026-55554, relates to the validateLocalUri() method. In versions prior to 3.15, this method enforced chroot boundaries with a strpos() prefix check after normalizing paths with realpath(). However, due to normalization stripping the trailing directory separator, the check was insufficient, potentially allowing directory traversal.
CVE-2026-59943 addresses a filesystem information leak vulnerability. If an attacker can supply unrestricted content for rendering, they can exploit the SVG rendering functionality. By using image references within a data-URI encoded SVG document, an attacker can leak filesystem information when Dompdf renders PDF files.
Another vulnerability, CVE-2026-55555, is a File Existence Oracle attack. Versions 3.15 and prior are vulnerable through manipulation of the CSS @font-face directive. By providing malicious HTML that repeatedly references local files via the file:// protocol, an attacker can trigger PHP memory exhaustion.
Finally, CVE-2026-59941 details an issue where Dompdf accepts a BMP image and generates a PDF-compatible PNG. This conversion relies solely on the header dimensions and does not check width times height before conversion through GD. A small 58-byte BMP with a header declaring large dimensions, such as 6000x6000, could be accepted and subsequently cause issues during processing.
These vulnerabilities underscore the importance of sanitizing input when using Dompdf, especially when rendering content from untrusted sources. Users are strongly advised to update to version 3.16 or later to mitigate these risks. The consistent patching across all four CVEs in a single release simplifies the update process for users.