CVE-2026-55554
Received Received - Intake

Path Traversal Vulnerability in Dompdf PHP Library

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with  realpath() . Because normalization strips the trailing directory separator from  $chrootPath , the check only verifies that  $chrootPath  is a string prefix of $realfile, so a chroot of  /var/www  also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-55554

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
dompdf dompdf to 3.16 (exc)
dompdf dompdf 3.16
dompdf dompdf to 3.1.6 (exc)
dompdf dompdf 3.1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55554 is a chroot validation bypass in Dompdf versions 3.15 and earlier. The validateLocalUri() method uses a flawed string prefix check to enforce directory restrictions. Due to path normalization stripping trailing slashes, attackers can bypass chroot boundaries by using paths with similar prefixes like /var/www2 when the intended chroot is /var/www. This allows reading sensitive files outside the allowed directory.

Detection Guidance

Check if your system uses Dompdf version 3.15 or earlier. Run: grep -r 'dompdf/dompdf' /path/to/composer.lock or composer show dompdf/dompdf. If version <=3.15, the system is vulnerable.

Impact Analysis

If you use Dompdf versions 3.15 or earlier, an attacker who controls part of the rendered HTML could exploit this to access sensitive files outside the intended restricted directories. This could lead to unauthorized data exposure or information disclosure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, which may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Upgrade Dompdf to version 3.16 or later immediately. Update via Composer: composer require dompdf/dompdf:^3.1.6. Review file access permissions and ensure sensitive directories are not exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart