File Existence Oracle Vulnerability in Dompdf by Dompdf

CVE-2026-55555

What is CVE-2026-55555?

Dompdf, an HTML to PDF converter for PHP, is susceptible to a File Existence Oracle attack. This occurs when an attacker manipulates the CSS @font-face directive and submits malicious HTML that references local files through the file:// protocol. Through this approach, they can trigger PHP memory exhaustion by exploiting the discrepancy in how Dompdf processes existing versus missing files. If existing files are referenced, Dompdf will repeatedly process them until the memory limit is surpassed, while missing files are ignored. This behavior allows attackers to leverage the oracles to enumerate sensitive files on the server, even with CHROOT restrictions. Successful exploitation requires an attacker to provide unsanitized HTML within a request allowing substantial data, considering also that a lower memory limit makes the overflow more achievable. This vulnerability has been addressed in Dompdf version 3.16.

References