CVE-2026-59943

Dompdf, an open-source PHP library that converts HTML to PDF, leaks information about the server filesystem when it renders PDFs from attacker-supplied content. If an application lets a user influence the HTML passed to Dompdf, the attacker can embed a data-URI encoded SVG containing image elements whose href or xlink:href attributes point at file:// paths; Dompdf responds differently when the referenced file or directory exists than when it does not, turning the renderer into an oracle for probing the host filesystem. An attacker gains low-impact disclosure of filesystem information (which files, directories, and paths exist on the server), which can aid reconnaissance and enable further attacks. Applications using Dompdf 3.15 or earlier are affected, and the vendor fixed the issue in version 3.16. No exploitation in the wild is reported (not in CISA KEV), but a public advisory with a proof of concept is available and EPSS estimates roughly a 0.3% chance of near-term exploitation.

What to do: Upgrade dompdf/dompdf to version 3.16 or later, checking composer.lock and any vendored or bundled copies shipped inside plugins and applications. Until patched, do not pass untrusted user-controlled HTML/SVG content to Dompdf, and restrict or disable SVG image references and local/remote file access where the library configuration allows. Prioritize auditing applications that render user-supplied content, since the flaw is only exploitable when attackers can influence what is rendered.