CVE-2026-55554 in Dompdf
Summary
by MITRE • 07/28/2026
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The dompdf library presents a critical path traversal vulnerability through its validateLocalUri() method implementation in versions 3.15 and earlier. This flaw stems from an insufficient chroot boundary enforcement mechanism that relies on a flawed string comparison approach. The vulnerability occurs when the system normalizes file paths using realpath() function, which strips trailing directory separators from the chroot path specification. This normalization process creates a dangerous condition where the subsequent strpos() prefix check fails to properly validate directory boundaries.
The technical implementation of this vulnerability exploits a fundamental flaw in path validation logic by treating the chroot path as a simple string prefix rather than a proper directory boundary. When dompdf processes HTML content that includes local file references, it attempts to validate whether these references remain within the designated chroot boundaries. The normalization step with realpath() removes trailing slashes from the chroot specification, causing the prefix matching to incorrectly accept paths that share common directory prefixes but exist outside the intended chroot scope. This creates a scenario where a chroot path of /var/www would incorrectly permit access to /var/www2, /var/www-admin, or /var/www_backup directories.
This vulnerability directly maps to CWE-22: Improper Limiting of a Pathname to a Restricted Directory and aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter. The operational impact extends beyond simple information disclosure as it enables attackers to potentially access sensitive files, configuration data, or system resources that should remain restricted within the chroot environment. Attackers could leverage this vulnerability by crafting HTML content with file references pointing to sibling directories that share common path prefixes with the intended chroot boundary.
The security implications of this flaw are particularly severe in web applications where dompdf processes user-supplied HTML content without proper sanitization. An attacker who can inject HTML into a document rendered by dompdf could construct malicious file paths that bypass the chroot protection entirely. This creates opportunities for unauthorized data access, potential privilege escalation, and information leakage that could expose system internals or sensitive application data.
The fix implemented in version 3.16 addresses this vulnerability through improved path validation logic that properly accounts for directory boundaries rather than relying on simple string prefix matching. Modern implementations ensure that chroot validation considers the complete path structure including proper directory separator handling, preventing the bypass conditions that existed in earlier versions. This remediation aligns with security best practices for sandboxed file access controls and proper input validation in web applications processing untrusted content. Organizations should prioritize upgrading to version 3.16 or later to eliminate this attack vector while maintaining proper security hygiene through regular dependency updates and vulnerability assessments.