{"id":"CVE-2026-59943","aliases":["GHSA-j8qw-6jw8-r297"],"title":"Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem","summary":"Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem","severity":"medium","cwe":["CWE-209"],"vendor":"dompdf","product":"dompdf/dompdf","ecosystem":"composer","affected":["dompdf/dompdf < 3.1.6"],"patched":["dompdf/dompdf 3.1.6"],"published":"2026-07-22","updated":"2026-07-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-j8qw-6jw8-r297","references":[{"url":"https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297"},{"url":"https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0"},{"url":"https://github.com/dompdf/dompdf/releases/tag/v3.1.6"},{"url":"https://github.com/advisories/GHSA-j8qw-6jw8-r297"}],"tags":["ghsa","composer"],"ingestedAt":"2026-07-22T23:07:32.469Z","epss":0.00299,"epssPercentile":0.22776,"slug":"CVE-2026-59943","body":"## Overview\n\n### Summary\nIf a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document.\n\n### Details\nUsing an `` element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the `href` or `xlink:href` attributes. When processing a file that does not exist (e.g. `file:///DOESNOTEXIST`), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem.\n\n```\n[Wed May 20 19:49:53 2026] PHP Warning: file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173\n[Wed May 20 19:49:53 2026] PHP Notice: getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196\n```\n\n### PoC\n\nFirst, the attacker renders this HTML document:\n```\n\n\n\n\n

\n Hello World!\n\n\n```\n\nThe `` tag contains the following SVG content:\n```xml\n\n\n```\n\nAs expected, the resulting PDF contains a broken image:\n $\"image\"$ \n\nHowever, when supplying a path to a file or directory that does not exist, for example:\n```xml\n\n\n```\n\nThe resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the \"Hello World!\" text 180 degrees from the expected position:\n\n $\"image\"$ \n\n### Impact\nBy exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem.\n\n## Affected packages\n\n- `dompdf/dompdf < 3.1.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `dompdf/dompdf 3.1.6`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}