--- id: CVE-2026-59943 aliases: - GHSA-j8qw-6jw8-r297 title: >- Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem summary: >- Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem severity: medium cwe: - CWE-209 vendor: dompdf product: dompdf/dompdf ecosystem: composer affected: - dompdf/dompdf < 3.1.6 patched: - dompdf/dompdf 3.1.6 published: '2026-07-22' updated: '2026-07-22' source: GHSA sourceUrl: 'https://github.com/advisories/GHSA-j8qw-6jw8-r297' references: - url: 'https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297' - url: >- https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0 - url: 'https://github.com/dompdf/dompdf/releases/tag/v3.1.6' - url: 'https://github.com/advisories/GHSA-j8qw-6jw8-r297' tags: - ghsa - composer ingestedAt: '2026-07-22T23:07:32.469Z' epss: 0.00423 epssPercentile: 0.3394 --- ## Overview ### Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. ### Details Using an `` element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the `href` or `xlink:href` attributes. When processing a file that does not exist (e.g. `file:///DOESNOTEXIST`), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. ``` [Wed May 20 19:49:53 2026] PHP Warning: file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173 [Wed May 20 19:49:53 2026] PHP Notice: getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196 ``` ### PoC First, the attacker renders this HTML document: ```

Hello World! ``` The `` tag contains the following SVG content: ```xml ``` As expected, the resulting PDF contains a broken image:

However, when supplying a path to a file or directory that does not exist, for example: ```xml ``` The resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the "Hello World!" text 180 degrees from the expected position:

### Impact By exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem. ## Affected packages - `dompdf/dompdf < 3.1.6` ## Remediation Upgrade to a patched release: - `dompdf/dompdf 3.1.6`