dompdf vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Latest dompdf vulnerabilities

CVE-2026-59943 — Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem (CVSS 5.3)
CVE-2026-59942 — Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps (CVSS 7.5)
CVE-2026-59941 — Dompdf: Uncontrolled resource consumption based on declared BMP dimensions (CVSS 7.5)
CVE-2026-56722 — Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI (CVSS 5.3)
CVE-2026-55555 — Dompdf: File existence oracle via font-face stylesheet declaration (CVSS 7.5)
CVE-2026-55554 — Dompdf: Chroot Validation Bypass (CVSS 7.5)
CVE-2021-3902 — Improper Restriction of XML External Entity Reference in dompdf/dompdf (CVSS 9.8)
CVE-2021-3838 — PHAR Deserialization in dompdf/dompdf (CVSS 9.8)
CVE-2023-50262 — Dompdf possible DoS caused by infinite recursion when parsing SVG images (CVSS 7.5)
CVE-2023-24813 — URI validation failure on SVG parsing. Bypass of CVE-2023-23924 (CVSS 9.8)
CVE-2023-23924 — URI validation failure on SVG parsing in Dompdf (CVSS 9.8)
CVE-2022-41343 — (CVSS 7.5)
CVE-2022-2400 — External Control of File Name or Path in dompdf/dompdf (CVSS 5.3)
CVE-2022-0085 — Server-Side Request Forgery (SSRF) in dompdf/dompdf (CVSS 5.3)
CVE-2022-28368 — (CVSS 9.8)
CVE-2014-5013 — (CVSS 8.8)
CVE-2014-5012 — (CVSS 6.5)
CVE-2014-5011 — (CVSS 6.5)