CVE-2026-56722

Received Received - Intake

Dompdf SVG Data URI Path Traversal Vulnerability

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-56722

Affected Vendors & Products

Vendor	Product	Version / Range
dompdf	dompdf	to 3.16 (exc)
dompdf	dompdf	3.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in Dompdf versions 3.15 and prior allows an attacker to bypass file access restrictions by embedding a target file path inside an SVG image delivered through a data URI. Dompdf processes the SVG twice, and the second pass does not enforce the same protections as the first. The php-svg-lib library, used in the second pass, lacks knowledge of the chroot directory and only blocks the phar:// scheme, enabling arbitrary file reads from the server's file system.

Detection Guidance

This vulnerability can be detected by checking the installed version of Dompdf. If you are running version 3.15 or earlier, your system is vulnerable. Run the command 'composer show dompdf/dompdf' to check the installed version.

Impact Analysis

An external, unauthenticated attacker could exploit this to read sensitive image files from your server's file system. This could lead to unauthorized access to confidential data, potential data breaches, or further exploitation of your system if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from this issue.

Mitigation Strategies

Upgrade Dompdf to version 3.16 or later to address the vulnerability. If upgrading is not immediately possible, review and restrict file access permissions on the server to limit exposure.

Hi! I’m here to help you understand CVE-2026-56722. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70