CVE-2026-59943

Name of the Vulnerable Software and Affected Versions Dompdf versions 3.x and earlier

Description An issue exists where a malicious actor providing unrestricted content for rendering can leak filesystem information. By using an <image> element within a data-URI encoded SVG document, an attacker can attempt to embed local files via the href or xlink:href attributes. The system behaves differently when processing a file that does not exist compared to when accessing a file or directory that actually exists on the filesystem, allowing an attacker to confirm the existence of specific files and directories on the backend.

Recommendations Update to version 3.16.