CVE-2026-55555

Dompdf, a PHP HTML-to-PDF converter library, versions 3.15 and earlier, suffers from an observable-discrepancy flaw (CWE-203) that lets an attacker determine whether arbitrary files exist on the server. An attacker who can inject unsanitized HTML into a PDF-generation request embeds CSS @font-face rules that repeatedly reference local files via file:// URLs: an existing file is re-processed until PHP hits an 'Allowed memory size exhausted' error, while a missing file fails fast and never triggers the memory limit. By observing whether this memory-exhaustion behavior occurs, the attacker can enumerate sensitive local files even where CHROOT restrictions are in place, though the impact is limited to file-existence disclosure (CVSS 4.0: 2.3, low). All deployments of Dompdf 3.15 or earlier whose applications pass attacker-controlled HTML to the library and accept large request payloads are affected. No exploitation in the wild is known (EPSS ~0.4% over 30 days, percentile 29; not in CISA KEV), but a public proof of concept is available in the vendor advisory GHSA-7x2p-4jvh-6384, and the fix is in Dompdf 3.16.

What to do: Upgrade Dompdf to version 3.16 or later. Until then, sanitize or restrict attacker-controlled HTML before PDF generation — especially stripping or limiting file:// references in CSS @font-face — and note that CHROOT alone does not close the oracle, while setting $_dompdf_show_warnings=false and a sane memory_limit raises the bar but does not eliminate the discrepancy. Verify whether your application passes user-supplied HTML to Dompdf; no in-the-wild exploitation is currently known.