CVE-2026-55554

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16

Description An issue exists in the validateLocalUri() method where chroot boundaries are enforced using a strpos() prefix check after paths are normalized with realpath(). Because normalization removes the trailing directory separator from the $chrootPath variable, the check only verifies that $chrootPath is a string prefix of the target file. This allows an attacker who controls part of the rendered HTML to bypass local file restrictions and read sensitive files in sibling directories that share the same prefix, such as accessing /var/www-admin when the chroot is set to /var/www.

Recommendations Update to version 3.16. As a temporary workaround, restrict the use of the validateLocalUri() method or carefully audit the directories defined in the chroot configuration to ensure no sensitive sibling directories exist with similar name prefixes.