Priority HIGH 83
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.83942 · Published 2022-04-03 · Fixed in 1.2.1 CWE-79
Priority HIGH 82
Dompdf is an HTML to PDF converter written in php.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.0249 · Published 2023-02-07 · Fixed in 2.0.3 CWE-436
Priority HIGH 82
Dompdf is an HTML to PDF converter.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.03572 · Published 2023-01-31 · Fixed in 2.0.2 CWE-551
Priority HIGH 82
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00951 · Published 2024-11-15 · Fixed in 2.0.0 CWE-611
Priority HIGH 82
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01432 · Published 2024-11-15 · Fixed in 2.0.0 CWE-502
Priority HIGH 72
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05984 · Published 2022-09-25 · Fixed in 2.0.1 CWE-552
Priority HIGH 67
Dompdf is an HTML to PDF converter for PHP.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.009 · Published 2026-07-28 · Fixed in 3.1.6 CWE-400
Priority HIGH 67
Dompdf is an HTML to PDF converter for PHP.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00448 · Published 2026-07-28 · Fixed in 3.1.6 CWE-20
Priority MEDIUM 61
Dompdf is an HTML to PDF converter for PHP.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00423 · Published 2026-07-28 · Fixed in 3.1.6 CWE-209
Priority MEDIUM 61
Dompdf is an HTML to PDF converter for PHP.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00644 · Published 2026-07-28 · Fixed in 3.1.6 CWE-400
Priority MEDIUM 45
Dompdf is an HTML to PDF converter for PHP.
CVSS 4.0LOW 2.3· Network · No auth · User interaction · EPSS 0.00508 · Published 2026-07-28 · Fixed in 3.1.6 CWE-203
Priority MEDIUM 45
Dompdf is an HTML to PDF converter for PHP.
CVSS 4.0LOW 2.3· Network · No auth · User interaction · EPSS 0.00451 · Published 2026-07-28 · Fixed in 3.1.6 CWE-20
Priority MEDIUM 45
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.04479 · Published 2020-01-10 · Fixed in 0.6.2 CWE-94
Priority LOW 36
Dompdf is an HTML to PDF converter for PHP.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01463 · Published 2023-12-13 · Fixed in 2.0.4 CWE-20
Priority LOW 32
DOMPDF before 0.6.2 allows Information Disclosure.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01494 · Published 2020-01-10 · Fixed in 0.6.2 CWE-200
Priority LOW 31
DOMPDF before 0.6.2 allows denial of service.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01227 · Published 2020-01-10 · Fixed in 0.6.2 CWE-400
Priority LOW 26
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01209 · Published 2022-07-18 · Fixed in 2.0.0 CWE-73
Priority LOW 26
Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00999 · Published 2022-06-28 · Fixed in 2.0.0 CWE-918
THREATIST.IORead the docs