{"id":"GHSA-x752-qjv4-c4hc","aliases":["CVE-2022-28368"],"title":"Remote code injection in dompdf/dompdf","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).","severity":"critical","score":9.8,"published":"2022-04-04T00:00:55.000Z","modified":"2024-02-16T08:01:54.574Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"dompdf/dompdf","sources":[{"name":"OSV · GHSA-x752-qjv4-c4hc","url":"https://osv.dev/vulnerability/GHSA-x752-qjv4-c4hc"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.2.1"}],"type":"ECOSYSTEM"}],"versions":["v0.6.0","v0.6.1","v0.6.2","v0.7.0","v0.7.0-beta","v0.7.0-beta2","v0.7.0-beta3","v0.8.0","v0.8.1","v0.8.2","v0.8.3","v0.8.4","v0.8.5","v0.8.6","v1.0.0","v1.0.1","v1.0.2","v1.1.0","v1.1.1","v1.2.0"],"fixed":["1.2.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-28368","https://github.com/dompdf/dompdf/issues/2598","https://github.com/dompdf/dompdf/pull/2808","https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d","https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-28368.yaml","https://github.com/advisories/GHSA-x752-qjv4-c4hc","https://github.com/dompdf/dompdf","https://github.com/snyk-labs/php-goof","https://packagist.org/packages/dompdf/dompdf#v1.2.1","https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce","http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html"],"sources":[{"name":"OSV","id":"GHSA-x752-qjv4-c4hc","modified":"2024-02-16T08:01:54.574621Z","url":"https://osv.dev/vulnerability/GHSA-x752-qjv4-c4hc"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T21:15:31.530Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[{"source":"Exploit-DB","id":"51270","url":"https://www.exploit-db.com/exploits/51270","checkedAt":"2026-10-28T07:55:38.811Z"}]}