Source: php-dompdf Version: 3.1.4+dfsg-2 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for php-dompdf. CVE-2026-55554[0]: | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and | prior, the validateLocalUri() method enforces chroot boundaries with | a strpos() prefix check after normalizing paths with realpath() . | Because normalization strips the trailing directory separator from | $chrootPath , the check only verifies that $chrootPath is a | string prefix of $realfile, so a chroot of /var/www also matches | sibling directories like /var/www2 , /var/www-admin, | or /var/www_backup. An attacker who controls part of the rendered | HTML could exploit this to escape the chroot and read sensitive | files outside the allowed directory. This issue has been fixed in | version 3.16. CVE-2026-55555[1]: | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior | are vulnerable to a File Existence Oracle attack through the | manipulation of the CSS @font-face directive. By providing malicious | HTML that references local files via the file:// protocol | repeatedly, an attacker can trigger PHP memory exhaustion. Because | Dompdf behaves differently depending on whether a referenced local | file exists (an existing file is processed repeatedly until it | triggers an "Allowed memory size exhausted" crash, whereas a missing | file fails fast or is ignored and never hits the memory limit), an | attacker can use this observable discrepancy as an oracle to | enumerate sensitive files on the server regardless of CHROOT | restrictions. Exploitation requires the attacker to supply | unrestricted or unsanitized HTML in a request that permits large | data, plus a configuration where Dompdf's memory limit is low enough | to be exhausted (with $_dompdf_show_warnings=true making the | overflow easier to reach). This issue has been fixed in version | 3.16. CVE-2026-56722[2]: | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and | prior, aAn attacker who controls the HTML input can bypass this | restriction by embedding a target file path inside an SVG image | delivered through a data: URI, because dompdf processes the SVG | twice and the second pass does not enforce the same protections as | the first. When rendering, dompdf hands the SVG to the separate | php-svg-lib library with external references forced on, and that | library has no knowledge of the chroot directory, blocks only the | phar:// scheme, and ultimately reads the referenced file with no | path or protocol validation. This lets an external, unauthenticated | attacker read arbitrary image files from the server's file system in | the default configuration. This issue has been fixed in version | 3.16. CVE-2026-59941[3]: | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior | accept a BMP image and generates a PDF-compatible PNG based only on | its declared header dimensions and never bounds width × height | before the image is converted through GD. A 58-byte BMP whose header | declares e.g. 6000×6000 is accepted and later drives | imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) | to allocate the full pixel canvas. A payload can fit in a single | HTTP request: the BMP can be inlined as a data:image/bmp;base64,… | URI inside attacker-controlled HTML, so no upload, no remote fetch, | and no chroot-reachable file is required. I measured a 169-byte | request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of | CPU/wall time, versus ~34 MB for an identically-sized benign request | — roughly a 12× memory amplification per request, repeatable and | unauthenticated. This issue has been fixed in version 3.16. CVE-2026-59942[4]: | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior | are vulnerable to a Denial of Service (DoS) attack via resource | exhaustion. An attacker can crash the PHP process by providing a | specially crafted HTML document containing a single image with | massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf | implements internal checks to validate image dimensions, these can | be bypassed by using a high-entropy image (such as random noise) | encoded in Base64 and wrapped in specific CSS containers. The | vulnerability exists because the dimension validation happens early, | but the resource allocation for calculating the object's bounding | box and internal buffers during the rendering phase does not | strictly limit the cumulative CPU time or memory usage for a single | object that has passed the initial check. An unauthenticated remote | attacker can cause a complete Denial of Service on the web server by | submitting a crafted HTML string. This affects any application that | allows users to provide HTML content or URLs that are subsequently | converted to PDF using Dompdf. This issue has been fixed in version | 3.16. CVE-2026-59943[5]: | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and | prior, if a malicious actor can supply unrestricted content for | rendering by Dompdf they can utilize the SVG rendering functionality | to leak filesystem information when rendering PDF files using image | references within a data-URI encoded SVG document. Using an <image> | element inside a data-URI embedded SVG, an attacker can attempt to | embed other files via the href or xlink:href attributes. When | processing a file that does not exist (e.g. file:///DOESNOTEXIST), | dompdf behaves differently than it does when accessing a file or | directory that actually exists on the filesystem. This issue has | been fixed in version 3.16. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-55554 https://www.cve.org/CVERecord?id=CVE-2026-55554 [1] https://security-tracker.debian.org/tracker/CVE-2026-55555 https://www.cve.org/CVERecord?id=CVE-2026-55555 [2] https://security-tracker.debian.org/tracker/CVE-2026-56722 https://www.cve.org/CVERecord?id=CVE-2026-56722 [3] https://security-tracker.debian.org/tracker/CVE-2026-59941 https://www.cve.org/CVERecord?id=CVE-2026-59941 [4] https://security-tracker.debian.org/tracker/CVE-2026-59942 https://www.cve.org/CVERecord?id=CVE-2026-59942 [5] https://security-tracker.debian.org/tracker/CVE-2026-59943 https://www.cve.org/CVERecord?id=CVE-2026-59943 Regards, Salvatore
