CVE-2026-56722 Details
Description
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.
A local file read vulnerability has been identified in Dompdf, an HTML to PDF converter for PHP, affecting versions through 3.15. The issue arises when an attacker embeds a file path within an SVG image using a data URI. Dompdf processes the SVG twice, and during the second pass, it fails to enforce the same restrictions as the first. The SVG is then handed off to the php-svg-lib library, which, unaware of Dompdf's chroot directory, reads the referenced file without proper validation. This vulnerability allows external, unauthenticated attackers to access arbitrary image files from the server's file system under default configurations.
Users can upgrade to Dompdf version 3.1.6, which addresses this vulnerability by improving the validation of file references in SVG images encoded as data URIs.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dompdf project dompdf | < 3.1.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | Initial Analysis | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |