VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 10, 2020· Updated Aug 6, 2024

CVE-2014-5011

CVE-2014-5011

Description

DOMPDF before 0.6.2 allows Information Disclosure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

DOMPDF before 0.6.2 is vulnerable to an information disclosure vulnerability, potentially exposing sensitive data.

CVE-2014-5011 is an information disclosure vulnerability in DOMPDF versions prior to 0.6.2. The exact nature of the vulnerability is not detailed in the public description, but it is classified as an information disclosure issue [2][3].

Exploitation likely involves crafting a malicious PDF or HTML input that triggers the disclosure. No authentication is required if the application allows unauthenticated PDF generation. The attack vector is network-based.

Successful exploitation could allow an attacker to read sensitive information from the server, such as configuration files, source code, or other data accessible to the web server.

The vulnerability is fixed in DOMPDF version 0.6.2 [1][3]. Users are advised to upgrade to this version or later. No workarounds are documented.

References
  1. Comparing v0.6.1...v0.6.2 · dompdf/dompdf
  2. NVD - CVE-2014-5011
  3. Release DOMPDF 0.6.2 · dompdf/dompdf

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
dompdf/dompdfPackagist
>= 0.6, < 0.6.20.6.2

Affected products

2

Patches

1
cc06008f7526

Restrict access to sensitive www content to authenticated users

https://github.com/dompdf/dompdfBrian SweeneyDec 7, 2015via ghsa
commit
3 files changed · +18 −3
  • www/debugger.php+3 −1 modified
    @@ -1,6 +1,8 @@
 <?php
+require_once "functions.inc.php";
+
 $allowed_hosts = array("::1", "127.0.0.1");
-if( !in_array($_SERVER['REMOTE_ADDR'], $allowed_hosts) ) {
+if( !auth_ok() || !in_array($_SERVER['REMOTE_ADDR'], $allowed_hosts) ) {
   die("Access denied to host at " . $_SERVER['REMOTE_ADDR']);
 }
  • www/demo.php+4 −2 modified
    @@ -6,7 +6,7 @@
 $local = array("::1", "127.0.0.1");
 $is_local = in_array($_SERVER['REMOTE_ADDR'], $local);
 
-if ( isset( $_POST["html"] ) && $is_local ) {
+if ( auth_ok() && $is_local && isset( $_POST["html"] ) ) {
 
   if ( get_magic_quotes_gpc() )
     $_POST["html"] = stripslashes($_POST["html"]);
@@ -27,7 +27,7 @@
 <a name="demo"> </a>
 <h2>Demo</h2>
 
-<?php if ($is_local) { ?>
+<?php if (auth_ok() && $is_local) { ?>
 
 <p>Enter your html snippet in the text box below to see it rendered as a
 PDF: (Note by default, remote stylesheets, images &amp; inline PHP are disabled.)</p>
@@ -79,6 +79,8 @@
     User input has been disabled for remote connections.
   </p>
   
+  <?php echo auth_get_link(); ?>
+
 <?php } ?>
 
 <?php include("foot.inc"); ?>
\ No newline at end of file
  • www/setup.php+11 −0 modified
    @@ -1,5 +1,9 @@
 <?php include("head.inc"); ?>
 
+<?php
+if (auth_ok()) {
+?>
+
 <a name="setup"> </a>
 <h2>Setup</h2>
 
@@ -296,5 +300,12 @@
 
 </table>
 
+<?php
+} else {
+  echo auth_get_link();
+}
+?>
+
+
 
 <?php include("foot.inc"); ?>
\ No newline at end of file

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.