CVE-2026-55555
Received Received - Intake

File Existence Oracle in Dompdf PHP Library

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with  $_dompdf_show_warnings=true  making the overflow easier to reach). This issue has been fixed in version 3.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-55555
EUVD
EUVD-2026-49997

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
dompdf dompdf to 3.16 (exc)
dompdf dompdf 3.16
dompdf dompdf to 3.1.6 (exc)
dompdf dompdf 3.1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55555 is a File Existence Oracle vulnerability in Dompdf versions 3.15 and prior. It allows attackers to check for the existence of local files on a server by exploiting how Dompdf handles the CSS @font-face directive. By repeatedly referencing files via the file:// protocol, an attacker can trigger PHP memory exhaustion if the file exists, but not if it doesn't. This observable difference lets them enumerate sensitive files despite CHROOT restrictions.

Detection Guidance

Monitor for repeated crashes in Dompdf processing when handling HTML with @font-face directives referencing local files. Check server logs for PHP memory exhaustion errors during PDF generation requests.

Impact Analysis

This vulnerability can allow attackers to determine if specific files exist on your server, potentially exposing sensitive information like configuration files, user data, or other confidential resources. It requires the attacker to provide unsanitized HTML input and relies on low PHP memory limits or specific configurations to exploit.

Compliance Impact

This vulnerability primarily impacts confidentiality by enabling unauthorized file existence checks. For GDPR, it could lead to unauthorized access to personal data, violating principles of data protection. For HIPAA, it may expose protected health information, risking compliance with security requirements. Organizations must patch to avoid regulatory penalties.

Mitigation Strategies
  • Upgrade Dompdf to version 3.16 or later to address the vulnerability.
  • Sanitize all HTML input to prevent malicious @font-face directives with file:// protocol.
  • Set $_dompdf_show_warnings=false to reduce memory exhaustion risk.
  • Increase PHP memory limits to make memory exhaustion harder to trigger.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart