Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability allows an attacker to read arbitrary files from the local filesystem by embedding a malicious SVG in the HTML input to dompdf. The root cause is a two-part issue in how dompdf handles SVG images provided as data URIs.
First, in Dompdf\Helpers::build_url, the data:// protocol was not correctly handled. This allowed an SVG with a malicious file path to bypass the initial URL validation. The path was not recognized as a local file path, so no chroot validation was applied at this stage.
Second, in Dompdf\Image\Cache::resolve_url, when dompdf pre-parses the SVG, it attempts to resolve any linked resources within it. If a resource path could not be resolved (which would be the case for a malicious path outside the chroot directory), the code would fail silently and continue. The unresolved, malicious path was then passed to the underlying php-svg-lib library for rendering. Since php-svg-lib is a separate library, it has no knowledge of dompdf's chroot restrictions and proceeds to read the file using file_get_contents, leading to the arbitrary file read vulnerability.
The patches address these issues by:
Dompdf\Helpers::build_url to treat data:// URIs as local file paths, ensuring they are subject to chroot validation.Dompdf\Image\Cache::resolve_url to throw an exception when an SVG resource cannot be resolved, thus preventing the malicious path from ever reaching php-svg-lib.Dompdf\Helpers::build_urlsrc/Helpers.php
Dompdf\Image\Cache::resolve_urlsrc/Image/Cache.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompdf/dompdf | composer | < 3.1.6 | 3.1.6 |