Dompdf Project
Dompdf Project Dompdf: vulnerabilidades y CVE
Dompdf Project Dompdf tiene 18 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE18
Últimos 12 meses6
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-59943 | Media (6.3) | 0.42% | — | 28 jul 2026 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem… |
| CVE-2026-59942 | Media (6.3) | 0.90% | — | 28 jul 2026 | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML… |
| CVE-2026-59941 | Media (6.3) | 0.64% | — | 28 jul 2026 | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is… |
| CVE-2026-56722 | Media (6.3) | 0.45% | — | 28 jul 2026 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data:… |
| CVE-2026-55555 | Baja (2.3) | 0.51% | — | 28 jul 2026 | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references… |
| CVE-2026-55554 | Baja (2.3) | 0.45% | — | 28 jul 2026 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because… |
| CVE-2021-3902 | Crítica (9.8) | 0.95% | — | 15 nov 2024 | An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0.… |
| CVE-2021-3838 | Crítica (9.8) | 1.4% | — | 15 nov 2024 | DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the… |
| CVE-2023-50262 | Alta (7.5) | 1.5% | — | 13 dic 2023 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not… |
| CVE-2023-24813 | Crítica (9.8) | 2.5% | — | 7 feb 2023 | Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href… |
| CVE-2023-23924 | Crítica (9.8) | 3.6% | — | 1 feb 2023 | Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through… |
| CVE-2022-41343 | Alta (7.5) | 6.0% | — | 25 sept 2022 | registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule. |
| CVE-2022-2400 | Media (5.3) | 1.2% | — | 18 jul 2022 | External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0. |
| CVE-2022-0085 | Media (5.3) | 1.00% | — | 28 jun 2022 | Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0. |
| CVE-2022-28368 | Crítica (9.8) | 82% | — | 3 abr 2022 | Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file). |
| CVE-2014-5013 | Alta (8.8) | 4.5% | — | 10 ene 2020 | DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383. |
| CVE-2014-5012 | Media (6.5) | 1.2% | — | 10 ene 2020 | DOMPDF before 0.6.2 allows denial of service. |
| CVE-2014-5011 | Media (6.5) | 1.5% | — | 10 ene 2020 | DOMPDF before 0.6.2 allows Information Disclosure. |