CVE-2026-59943

Received Received - Intake

Dompdf SVG File Disclosure via Data-URI

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-59943

Affected Vendors & Products

Vendor	Product	Version / Range
dompdf	dompdf	to 3.16 (exc)
dompdf	dompdf	3.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

Dompdf is a PHP library that converts HTML to PDF. In versions before 3.16, if an attacker can provide unfiltered content for rendering, they can exploit SVG functionality to leak filesystem information. This is done by embedding an SVG with an image element referencing non-existent files via data-URI. The library behaves differently when accessing non-existent files, allowing information disclosure.

Detection Guidance

To detect this vulnerability, check if your Dompdf version is 3.15 or earlier. Run: composer show dompdf/dompdf. If the version is below 3.16, the system is vulnerable.

Impact Analysis

If you use Dompdf versions 3.15 or earlier, an attacker could potentially access sensitive filesystem information by crafting malicious SVG content. This could lead to unauthorized data exposure, including directory structures or file contents, depending on the server's permissions.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy) by exposing sensitive filesystem data. Organizations may face legal penalties or reputational damage if exploited, as unauthorized data access breaches regulatory standards.

Mitigation Strategies

Upgrade Dompdf to version 3.16 or later immediately. Update your PHP application dependencies using: composer require dompdf/dompdf:^3.16.

Hi! I’m here to help you understand CVE-2026-59943. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70