CVE-2021-3902

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

• CWE-611

• https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799Patch
• https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Nov 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39014IBM Cloud Object System 3.15.8.97 is vulnerable to stored cr…5.4
• CVE-2021-39015IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0…5.4
• CVE-2021-39016IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6…4.3
• CVE-2021-39017IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6…6.5
• CVE-2021-39018IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6…4.3
• CVE-2021-39019IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6…6.5
• CVE-2021-39020IBM Guardium Data Encryption (GDE) 4.0.0.7 and lower stores …5.3
• CVE-2021-39021IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves different…5.3
• CVE-2021-39022IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves…8.8
• CVE-2021-39023IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could all…7.5
• CVE-2021-39024IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 is vu…6.1
• CVE-2021-39025IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 could…5.3