Vulnerabilities

Dompdf, a widely used PHP library that converts HTML to PDF, is vulnerable to an unauthenticated denial-of-service flaw (CWE-400, uncontrolled resource consumption) affecting versions 3.15 and prior. An attacker supplies HTML containing a single image with extreme dimensions (e.g., 30,000x30,000 pixels), encoded as high-entropy Base64 data and wrapped in specific CSS containers, which bypasses Dompdf's early dimension-validation checks; during rendering, bounding-box and internal buffer calculations then consume unbounded CPU time and memory. The attacker gains the ability to crash the PHP process, completely denying service to PDF generation and potentially to the web application sharing that process. Any application that lets users supply HTML content or URLs that are then converted to PDF with Dompdf is affected; applications that only render internally generated documents are less directly exposed. No in-the-wild exploitation is reported (EPSS 0.7%, not in CISA KEV), but a public security advisory with proof-of-concept details exists and a fix is available in version 3.16.

Do: Upgrade Dompdf to version 3.16 or later, and verify that transitive dependencies (e.g., PHP frameworks or CMS plugins that bundle Dompdf) pull in the fixed release. As interim mitigation, sanitize or restrict user-supplied HTML, cap image dimensions and Base64 image size, and enforce strict per-render PHP memory and execution-time limits. Prioritize auditing any application that converts end-user-provided HTML or URLs to PDF, since those configurations are the directly exploitable ones.

DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.

Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, prior to version 2.0.4, a recursive chained using two or more SVG documents is not correctly validated. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. php-svg-lib, when run in isolation, does not support SVG references for `image` elements. However, when used in combination with Dompdf, php-svg-lib will process SVG images referenced by an `image` element. Dompdf currently includes validation to prevent self-referential `image` references, but a chained reference is not checked. A malicious actor may thus trigger infinite recursion by chaining references between two or more SVG images. When Dompdf parses a malicious payload, it will crash due after exceeding the allowed execution time or memory usage. An attacker sending multiple request to a system can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 2.0.4 contains a fix for this issue.

Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of `image` tags and respects `xlink:href` even if `href` is specified. However, php-svg-lib, which is later used to parse the svg file, parses the href attribute. Since `href` is respected if both `xlink:href` and `href` is specified, it's possible to bypass the protection on the Dompdf side by providing an empty `xlink:href` attribute. An attacker can exploit the vulnerability to call arbitrary URLs with arbitrary protocols if they provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, which will lead, at the very least, to arbitrary file deletion and might lead to remote code execution, depending on available classes. This vulnerability has been addressed in commit `95009ea98` which has been included in release version 2.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing ` ` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.

Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).