CVE-2026-56722 in dompdf
Summary
by MITRE • 07/29/2026
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The dompdf library presents a critical server-side request forgery vulnerability that allows unauthenticated attackers to read arbitrary files from the server's filesystem through improper input validation and processing of SVG images. This vulnerability affects versions 3.15 and prior, where the library fails to properly enforce file access restrictions when processing HTML input containing embedded SVG elements. The flaw stems from dompdf's dual-processing approach of SVG content, where the initial parsing pass applies certain security constraints while the second processing pass bypasses these protections entirely.
The technical implementation of this vulnerability exploits the interaction between dompdf and the php-svg-lib library, which handles SVG rendering operations. When an attacker supplies HTML containing an SVG image with a data: URI scheme, the first pass through dompdf applies some restrictions but does not adequately validate file paths or protocols. During the second processing pass, the content is handed off to php-svg-lib with external references enabled, and this library operates without knowledge of dompdf's configured chroot directory restrictions. The php-svg-lib component only blocks phar:// schemes but allows other potentially dangerous protocols and lacks comprehensive path validation mechanisms.
This vulnerability creates a direct path traversal condition that enables attackers to access files outside the intended document root through carefully crafted SVG elements. The impact extends beyond simple information disclosure, as attackers can potentially read sensitive configuration files, database credentials, application source code, or other system resources that may be stored within the server's file hierarchy. The default configuration of dompdf leaves no protection against such attacks, making any web application using the library vulnerable to this class of exploitation.
The security implications align with CWE-22 (Path Traversal) and CWE-94 (Code Injection) categories, where improper input validation leads to unauthorized access to system resources. From an attack perspective, this vulnerability maps to techniques described in MITRE ATT&CK framework under T1566 (Phishing with Malicious Attachments) and T1083 (File and Directory Discovery) as attackers can leverage this flaw to discover and extract sensitive files from compromised systems. The vulnerability has been addressed in version 3.16 through enhanced input validation and improved handling of SVG external references.
Mitigation strategies include immediate upgrading to dompdf version 3.16 or later, implementing strict input validation for all HTML content processed through the library, configuring appropriate chroot restrictions, and monitoring for suspicious file access patterns. Organizations should also consider restricting external resource loading in their applications and implementing additional layers of security such as network segmentation and privilege separation to limit potential damage from successful exploitation attempts.