{"id":"GHSA-qr6q-w4gj-3865","aliases":["CVE-2014-2383"],"title":"DOMPDF Arbitrary File Read","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"dompdf.php in dompdf before 0.6.1, when `DOMPDF_ENABLE_PHP` is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a `php://filter/read=convert.base64-encode/resource` in the input_file parameter.","severity":"medium","score":null,"published":"2022-05-14T02:53:19.000Z","modified":"2024-12-08T05:33:39.406Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"dompdf/dompdf","sources":[{"name":"OSV · GHSA-qr6q-w4gj-3865","url":"https://osv.dev/vulnerability/GHSA-qr6q-w4gj-3865"}],"ranges":[{"events":[{"introduced":"0.6.0"},{"fixed":"0.6.1"}],"type":"ECOSYSTEM"}],"versions":["v0.6.0"],"fixed":["0.6.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2014-2383","https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028","https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2014-2383.yaml","https://github.com/dompdf/dompdf","https://web.archive.org/web/20151215023329/http://www.securityfocus.com/archive/1/531912/100/0/threaded","http://seclists.org/fulldisclosure/2014/Apr/258"],"sources":[{"name":"OSV","id":"GHSA-qr6q-w4gj-3865","modified":"2024-12-08T05:33:39.406584Z","url":"https://osv.dev/vulnerability/GHSA-qr6q-w4gj-3865"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T02:30:33.887Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[{"source":"Exploit-DB","id":"33004","url":"https://www.exploit-db.com/exploits/33004","checkedAt":"2026-10-29T00:00:35.338Z"}]}