Dompdf - vulnerabilities (CVEs)
17 CVEs in 3 products, 0 in the last 30 days, newest from 2026-07-28.
Products
- Dompdf - 9 CVEs
- Dompdfdompdf - 4 CVEs
- Php-svg-lib - 3 CVEs
Newest CVEs of Dompdf
- CVE-2026-59941 - CVSS 7.5 (high), 2026-07-28: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header…
- CVE-2026-59942 - CVSS 7.5 (high), 2026-07-28: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker…
- CVE-2026-59943 - CVSS 6.3 (medium), 2026-07-28: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can…
- CVE-2026-56722 - CVSS 6.3 (medium), 2026-07-28: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a…
- CVE-2026-55554 - CVSS 7.5 (high), 2026-07-28: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check…
- CVE-2026-55555 - CVSS 7.5 (high), 2026-07-28: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS…
- CVE-2021-3902 - CVSS 9.8 (critical), 2024-11-15: An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and…
- CVE-2021-3838 - CVSS 9.8 (critical), 2024-11-15: DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents()…
- CVE-2024-25117 - CVSS 9.8 (critical), 2024-02-21: php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't…
- CVE-2023-50262 - CVSS 7.5 (high), 2023-12-13: Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One…
- CVE-2023-50251 - CVSS 7.5 (high), 2023-12-12: php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an…
- CVE-2023-50252 - CVSS 9.8 (critical), 2023-12-12: php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the…
- CVE-2023-24813 - CVSS 10 (critical), 2023-02-07: Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call…
- CVE-2023-23924 - CVSS 10 (critical), 2023-02-01: Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This…
- CVE-2022-2400 - CVSS 5.3 (medium), 2022-07-18: External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- CVE-2022-0085 - CVSS 5.3 (medium), 2022-06-28: Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
- CVE-2014-2383 - CVSS 6.8 (medium), 2014-04-28: dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files…
