CVE-2026-59943: fallo de gravedad media en dompdf
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.3epss 0.4%
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
dompdf · dompdfCVEs relacionadas — dompdf
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-23924CRITICALURI validation failure on SVG parsing in DompdfEPSS 3.6%CVE-2023-24813CRITICALURI validation failure on SVG parsing. Bypass of CVE-2023-23924EPSS 2.5%CVE-2023-50262MEDIUMDompdf possible DoS caused by infinite recursion when parsing SVG imagesEPSS 1.5%CVE-2026-59942MEDIUMDompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image BitmapsEPSS 0.9%CVE-2026-59941MEDIUMDompdf: Uncontrolled resource consumption based on declared BMP dimensionsEPSS 0.6%CVE-2026-55555LOWDompdf: File existence oracle via font-face stylesheet declarationEPSS 0.5%