Read the docs
TI-2026-42750 Aliases CVE-2026-59943GHSA-j8qw-6jw8-r297

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Priority MEDIUM 61CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-209.

Summary

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed dompdf (dompdf): 3.1.6dompdf/dompdf (Packagist): 3.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dompdfdompdfbefore 3.1.63.1.6Patch availableCNA
—dompdf/dompdf (Packagist)before 3.1.63.1.6Patch availableGHSA-j8qw-6jw8-r297
  • dompdf Vendordompdf Affected before 3.1.6 Fixed in 3.1.6 Patch available CNA
  • dompdf/dompdf (Packagist) Vendor— Affected before 3.1.6 Fixed in 3.1.6 Patch available GHSA-j8qw-6jw8-r297

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:*before 3.1.6VulnerableDompdf Project
  • cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:* Versions before 3.1.6 Vulnerable ·Dompdf Project

Remediation

  • Fix · CNA dompdf (dompdf) Fixed in 3.1.6
  • Fix · GHSA-j8qw-6jw8-r297 dompdf/dompdf (Packagist) Fixed in 3.1.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59943
  2. 2026-10-03 Alias added: GHSA-j8qw-6jw8-r297

References

Exploit 1

Patch 1

Other 2

  • TI-2023-10313 URI validation failure on SVG parsing. Bypass of CVE-2023-23924 CVSS 3.1CRITICAL 10.0
  • TI-2023-09722 URI validation failure on SVG parsing in Dompdf CVSS 3.1CRITICAL 10.0
  • TI-2021-02812 Improper Restriction of XML External Entity Reference in dompdf/dompdf CVSS 3.1CRITICAL 9.8
  • TI-2021-02769 PHAR Deserialization in dompdf/dompdf CVSS 3.1CRITICAL 9.8
  • TI-2024-16571 php-svg-lib lacks path validation on font through SVG inline styles CVSS 3.1CRITICAL 9.8
  • TI-2023-27479 php-svg-lib possible DoS caused by infinite recursion when parsing SVG document CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences