{"id":"CVE-2026-59943","aliases":["GHSA-j8qw-6jw8-r297"],"url":"https://o3.security/vulnerability/CVE-2026-59943","summary":"Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem","details":"### Summary\nIf a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document.\n\n### Details\nUsing an `` element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the `href` or `xlink:href` attributes. When processing a file that does not exist (e.g. `file:///DOESNOTEXIST`), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem.\n\n```\n[Wed May 20 19:49:53 2026] PHP Warning: file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173\n[Wed May 20 19:49:53 2026] PHP Notice: getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196\n```\n\n### PoC\n\nFirst, the attacker renders this HTML document:\n```\n\n\n\n\n

\n Hello World!\n\n\n```\n\nThe `` tag contains the following SVG content:\n```xml\n\n\n```\n\nAs expected, the resulting PDF contains a broken image:\n $\"image\"$ \n\nHowever, when supplying a path to a file or directory that does not exist, for example:\n```xml\n\n\n```\n\nThe resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the \"Hello World!\" text 180 degrees from the expected position:\n\n $\"image\"$ \n\n### Impact\nBy exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem.","published":"2026-07-28T20:19:22.746Z","modified":"2026-10-21T02:30:25.287124579Z","cvss":null,"epss":{"score":0.00299,"percentile":0.22533,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"dompdf/dompdf","fixedVersion":"3.1.6"}],"fix":{"url":"https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0","label":"dompdf/dompdf@6a58996"},"references":[{"type":"WEB","url":"https://github.com/dompdf/dompdf/releases/tag/v3.1.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59943.json"},{"type":"ADVISORY","url":"https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59943"},{"type":"FIX","url":"https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0"},{"type":"PACKAGE","url":"https://github.com/dompdf/dompdf"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:25.287124579Z"}}