File Path Disclosure in Dompdf HTML to PDF Converter for PHP

CVE-2026-56722

What is CVE-2026-56722?

Dompdf, an HTML to PDF converter for PHP, is vulnerable to a file path disclosure issue in versions 3.15 and earlier. Attackers can exploit this vulnerability by embedding malicious SVG images within data URIs that bypass the initial security restrictions. While processing these SVG images, dompdf renders them multiple times, with the second rendering lacking the same protective measures. Furthermore, Dompdf utilizes the php-svg-lib library, which processes external references without awareness of the secure chroot directory settings. This flaw allows unauthenticated attackers to access arbitrary files from the server's filesystem, posing significant security risks. This vulnerability has been addressed in Dompdf version 3.16.

References