CVE-2026-55554

Dompdf versions 3.15 and prior contain a flaw in the validateLocalUri() method, where chroot boundaries are enforced with a strpos() prefix check after realpath() normalization. Because normalization strips the trailing separator from the chroot path, the check accepts any path whose string begins with the chroot characters, so a chroot of /var/www also permits access to sibling directories such as /var/www2 or /var/www_backup. An attacker who controls part of the HTML being rendered to PDF can trigger the flawed check and read files outside the intended chroot directory. Only PHP applications using dompdf 3.15 or earlier that render attacker-controlled content referencing local file paths are affected. There is no evidence of in-the-wild exploitation; a public security advisory (GHSA-wvh6-f5jh-8gw4) is available and EPSS estimates a low 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade dompdf to version 3.16, which corrects the chroot boundary check. If upgrading is not immediately possible, avoid rendering attacker-controlled HTML that references local file URIs, or verify that resolved local paths fall within the configured chroot with a proper directory-boundary check. Audit PHP applications and Composer dependencies for dompdf usage and confirm which deployments pass untrusted user input into PDF generation.