CVE catalog

CVE-2026-59943

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to

[CVE catalog]

Severity
Medium · CVSS 6.3
Published
Source
[NVD] · [CVE record]
EPSS
0.42% · Oct 25, 2026

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-dompdfsid3.1.4+dfsg-2vulnerable
Debianphp-dompdfbookworm2.0.3+dfsg-1+deb12u1vulnerable
Composerdompdf/dompdfNot reported3.1.6fixed
Ubuntuphp-dompdfpro0.6.2+dfsg-3vulnerable
Ubuntuphp-dompdfpro0.6.2+dfsg-3ubuntu0.18.04.1~esm1vulnerable
Ubuntuphp-dompdf20.040.6.2+dfsg-3vulnerable
Ubuntuphp-dompdf20.040.6.2+dfsg-3ubuntu0.20.04.1vulnerable
Ubuntuphp-dompdf22.040.6.2+dfsg-3.1vulnerable
Ubuntuphp-dompdf22.040.6.2+dfsg-3.1ubuntu0.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-dompdfsourcesid(unfixed)not yet assignedNot reported[1142987]
Debianphp-dompdfsourcebookworm(unfixed)not yet assignedNot reported[1142987]
Composerdompdf/dompdfcomposerNot reported3.1.6Not reportedNot reportedNot reported

[Debian bug #1142987]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-dompdf]Affected
    Details (2)

    • 2.0.3+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · php-dompdf · debian · bookworm; nvd · php-dompdf · debian · 12

    • 2.0.3+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · php-dompdf · debian · bookworm; nvd · php-dompdf · debian · 12

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]