CVE-2026-56722

Name of the Vulnerable Software and Affected Versions dompdf (affected versions not specified)

Description Insufficient input validation allows a remote attacker to read arbitrary images from the server's file system, bypassing the chroot restriction. The issue occurs because the software handles SVG content twice: first through its own validator and then via the php-svg-lib library. While the initial validator checks for chroot restrictions, the second pass via php-svg-lib does not apply these protections. An attacker can bypass the security mechanism by wrapping a link to a local file within an SVG and delivering it via a data: URI. The php-svg-lib library then processes the <image> element and uses the file get contents() function to read the target file without protocol or path validation, embedding the result into the generated PDF.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.