Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Jul 28, 2026Dompdf is an HTML to PDF converter for PHP.CVE-2026-59943 · Other software · dompdf · reported by GitHubMedium 6.3
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Dompdf is an HTML to PDF converter for PHP.CVE-2026-59942 · Other software · dompdf · reported by GitHubMedium 6.3
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers. The vulnerability exists because the dimension validation happens early, but the resource allocation for calculating the object's bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. An unauthenticated remote attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. This issue has been fixed in version 3.16.
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Dompdf is an HTML to PDF converter for PHP.CVE-2026-59941 · Other software · dompdf · reported by GitHubMedium 6.3
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Dompdf is an HTML to PDF converter for PHP.CVE-2026-56722 · Other software · dompdf · reported by GitHubMedium 6.3
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Dompdf is an HTML to PDF converter for PHP.CVE-2026-55555 · Other software · dompdf · reported by GitHubLow 2.3
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Dompdf is an HTML to PDF converter for PHP.CVE-2026-55554 · Other software · dompdf · reported by GitHubLow 2.3
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserializationCVE-2021-3902 · Other software · dompdf · reported by security@huntr.devCritical 9.8
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() functCVE-2021-3838 · Other software · dompdf · reported by security@huntr.devCritical 9.8
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library.CVE-2024-25117 · Other software · dompdf · reported by GitHubMedium 6.8
php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib. The `Style::fromAttributes(`), or the `Style::parseCssStyle()` should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the `Style::fromStyleSheets` might be reused. Libraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even remote code execution, if they do not double check the value of the `fontName` that is passed by php-svg-lib. Version 0.5.2 contains a fix for this issue.
- Product
- php-svg-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Dompdf is an HTML to PDF converter for PHP.CVE-2023-50262 · Other software · dompdf · reported by GitHubMedium 5.3
Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, prior to version 2.0.4, a recursive chained using two or more SVG documents is not correctly validated. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. php-svg-lib, when run in isolation, does not support SVG references for `image` elements. However, when used in combination with Dompdf, php-svg-lib will process SVG images referenced by an `image` element. Dompdf currently includes validation to prevent self-referential `image` references, but a chained reference is not checked. A malicious actor may thus trigger infinite recursion by chaining references between two or more SVG images. When Dompdf parses a malicious payload, it will crash due after exceeding the allowed execution time or memory usage. An attacker sending multiple request to a system can potentially cause resource exhaustion to the point that the system is unable to handle incom
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023php-svg-lib is an SVG file parsing / rendering library.CVE-2023-50252 · Other software · dompdf · reported by GitHubHigh 8.3
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.
- Product
- php-svg-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023php-svg-lib is an SVG file parsing / rendering library.CVE-2023-50251 · Other software · dompdf · reported by GitHubMedium 5.3
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue.
- Product
- php-svg-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023Dompdf is an HTML to PDF converter written in php.CVE-2023-24813 · Other software · dompdf · reported by GitHubCritical 10
Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of `image` tags and respects `xlink:href` even if `href` is specified. However, php-svg-lib, which is later used to parse the svg file, parses the href attribute. Since `href` is respected if both `xlink:href` and `href` is specified, it's possible to bypass the protection on the Dompdf side by providing an empty `xlink:href` attribute. An attacker can exploit the vulnerability to call arbitrary URLs with arbitrary protocols if they provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, which will lead, at the very least, to arbitrary file deletion and might lead to remote code execution, depending on available classes. This vulnerability has been addressed in commit `95009ea98` which has been included in release version 2.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023PDF Generator for: Includes a vendored dompdf example fileCVE-2022-4321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin
- Product
- PDF Generator for
- Fixed in
- 1.1.2
- What to do
- Update PDF Generator for to 1.1.2 or newer.
Jan 31, 2023Dompdf is an HTML to PDF converter.CVE-2023-23924 · Other software · dompdf · reported by GitHubCritical 10
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.
- Product
- dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2022registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstCVE-2022-41343 · Other software · Dompdf Project · reported by MITREHigh 7.5
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.CVE-2022-2400 · Other software · dompdf · reported by security@huntr.devMedium 5.3
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.CVE-2022-0085 · Other software · dompdf · reported by security@huntr.devMedium 5.3
Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2022Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input filCVE-2022-28368 · Other software · Dompdf Project · reported by MITRECritical 9.8
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 29, 2021tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php.CVE-2021-43691 · Other software · Tripexpress Project · reported by MITRECritical 9.8
tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php. The variable src is coming from $_SERVER["argv"] then there is a path manipulation vulnerability.
- Product
- Tripexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script CVE-2021-40925 · Other software · Faveohelpdesk · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"] parameter.
- Product
- Faveo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2021Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter inCVE-2020-36115 · Other software · Egavilanmedia · reported by MITREMedium 5.4
Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'.
- Product
- Phpcrud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 10, 2020DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.CVE-2014-5013 · Other software · Dompdf Project · reported by MITREHigh 8.8
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2020DOMPDF before 0.6.2 allows denial of service.CVE-2014-5012 · Other software · Dompdf Project · reported by MITREMedium 6.5
DOMPDF before 0.6.2 allows denial of service.
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2020DOMPDF before 0.6.2 allows Information Disclosure.CVE-2014-5011 · Other software · Dompdf Project · reported by MITREMedium 6.5
DOMPDF before 0.6.2 allows Information Disclosure.
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2014Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.CVE-2014-6235 · Other software · Kennziffer · reported by MITREHigh 7.5
Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.
- Product
- KE Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2014dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files vCVE-2014-2383 · Other software · Dompdf · reported by MITREMedium 6.8
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Oct 7, 2011PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file paCVE-2010-4879 · Other software · Digitaljunkies · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file parameter.
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.