CyberRota Analysis
AI-GeneratedDompdf versions 3.15 and earlier are vulnerable due to a flaw in the validateLocalUri() method, which inadequately enforces chroot boundaries, allowing attackers to escape the chroot directory and access sensitive files outside the intended directory. This vulnerability can be exploited by an attacker who can manipulate the rendered HTML, posing a significant risk to web applications utilizing Dompdf for PDF generation. Organizations using affected versions should prioritize upgrading to version 3.16 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
Related CVEs
Other vulnerabilities affecting the same vendor(s)