CVE-2022-41343: Dompdf allows remote file inclusion because URI validation failure does not halt font registration

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-25 · updated 2026-06-17
Weakness: CWE-552

Description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

Affected products

dompdf: before 2.0.1 — fixed in 2.0.1
Packagist Dompdf/Dompdf: before 2.0.1; v0.6.0, v0.6.1, v0.6.2, v0.7.0, v0.7.0-beta, v0.7.0-beta2 (+17) — fixed in 2.0.1

How to fix

Upgrade to a fixed version: dompdf 2.0.1; Packagist Dompdf/Dompdf 2.0.1. Check the vendor advisory for mitigations.

References

https://github.com/dompdf/dompdf/issues/2994
https://github.com/dompdf/dompdf/pull/2995
https://github.com/dompdf/dompdf/releases/tag/v2.0.1
https://tantosec.com/blog/cve-2022-41343/
https://github.com/dompdf/dompdf/issues/2994
https://github.com/dompdf/dompdf/pull/2995
https://github.com/dompdf/dompdf/releases/tag/v2.0.1
https://tantosec.com/blog/cve-2022-41343/
https://tantosec.com/blog/cve-2022-41343/

Get alerted when CVE-2022-41343 or the next vulnerability affects your stack