DO
Product
Dompdf
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 6Low 0
Watch
Add Dompdf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3902 | 9.8 | Nov 15 | Improper Restriction of XML External Entity Reference in dompdf/dompdf Affected: before 2.0.0 |
| CVE-2021-3838 | 9.8 | Nov 15 | PHAR Deserialization in dompdf/dompdf Affected: before 2.0.0 |
| CVE-2023-24813 | 9.8 | Feb 7 | Dompdf is an HTML to PDF converter written in php Affected: 2.0.2 |
| CVE-2023-23924 | 9.8 | Feb 1 | Dompdf is an HTML to PDF converter Affected: 2.0.1 |
| CVE-2022-28368 | 9.8 | Apr 3 | Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file) Affected: before 1.2.1 |
| CVE-2014-5013 | 8.8 | Jan 10 | DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383 Affected: before 0.6.2 |
| CVE-2026-59941 | 7.5 | Jul 28 | Dompdf: Uncontrolled resource consumption based on declared BMP dimensions Affected: before 3.1.6 |
| CVE-2026-59942 | 7.5 | Jul 28 | Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps Affected: before 3.1.6 |
| CVE-2026-55554 | 7.5 | Jul 28 | Dompdf: Chroot Validation Bypass Affected: before 3.1.6 |
| CVE-2026-55555 | 7.5 | Jul 28 | Dompdf: File existence oracle via font-face stylesheet declaration Affected: before 3.16 |
| CVE-2023-50262 | 7.5 | Dec 13 | Dompdf possible DoS caused by infinite recursion when parsing SVG images Affected: through 2.0.3 |
| CVE-2022-41343 | 7.5 | Sep 25 | registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a… Affected: before 2.0.1 |
| CVE-2014-5012 | 6.5 | Jan 10 | DOMPDF before 0.6.2 allows denial of service Affected: before 0.6.2 |
| CVE-2014-5011 | 6.5 | Jan 10 | DOMPDF before 0.6.2 allows Information Disclosure Affected: before 0.6.2 |
| CVE-2026-59943 | 5.3 | Jul 28 | Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem Affected: before 3.1.6 |
| CVE-2026-56722 | 5.3 | Jul 28 | Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI Affected: before 3.1.6 |
| CVE-2022-2400 | 5.3 | Jul 18 | External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0 Affected: before 2.0.0 |
| CVE-2022-0085 | 5.3 | Jun 28 | Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0 Affected: before 2.0.0 |
Showing 18