Directory Traversal Vulnerability in Dompdf HTML to PDF Converter
CVE-2026-55554

2.3LOW

Key Information:

Vendor

DomPDF

Status
DomPDF
Vendor
CVE Published:
28 July 2026

What is CVE-2026-55554?

The Dompdf HTML to PDF converter suffers from a directory traversal vulnerability due to improper checks in the validateLocalUri() method. Versions 3.15 and earlier fail to adequately enforce chroot directory boundaries. This oversight allows malicious actors to exploit the normalization process of file paths, enabling them to access sensitive files located outside the designated safe directory. Attackers who can manipulate the HTML content rendered by Dompdf may execute this vulnerability by leveraging sibling directories, thus escaping the intended chroot restrictions. This security issue has been addressed in version 3.16.

Affected Version(s)

dompdf < 3.1.6

References

https://github.com/dompdf/dompdf/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/dompdf/dompdf/releases/tag/v3.1.6
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.