CVE-2026-56722

Dompdf, a widely used PHP HTML-to-PDF converter, in versions 3.15 and prior can be tricked into bypassing its local-file-access restrictions when an SVG image is delivered inside a data: URI within HTML supplied by the attacker. Because dompdf processes the SVG twice and the second pass is handled by the separate php-svg-lib library with external references forced on — and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and performs no path or protocol validation — the referenced file is read without the usual protections. An external, unauthenticated attacker who can influence the HTML being converted to PDF gains the ability to read arbitrary image files from the server's file system in the default configuration (CVSS 4.0: 6.3 medium, low confidentiality impact; exploitation requires attacker-controlled HTML input, per the AT:P score). Any application using dompdf 3.15 or earlier to render HTML containing untrusted input is affected. No confirmed in-the-wild exploitation is reported (EPSS ~0.3%, 26th percentile; not in CISA KEV), but a public vendor advisory with a PoC reference exists (GHSA-cx96-42px-69fm) and the fix shipped in version 3.16.

What to do: Upgrade dompdf to version 3.16. If upgrading immediately is not possible, sanitize or restrict untrusted HTML before conversion — particularly SVG images, and especially those delivered via data: URIs — and verify whether PDF-rendering endpoints accept unauthenticated, attacker-supplied markup and whether sensitive image files reside on the host. Review the vendor advisory GHSA-cx96-42px-69fm for official guidance.