CVE-2023-23924

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.

• CWE-551
• CWE-863

• https://github.com/dompdf/dompdf/commit/7558f07f693b2ac3266089f21051e6b78c6a0c85Patch, Third Party Advisory
• https://github.com/dompdf/dompdf/releases/tag/v2.0.2Release Notes, Third Party Advisory
• https://github.com/dompdf/dompdf/security/advisories/GHSA-3cw5-7cxw-v5qgExploit, Third Party Advisory
• https://github.com/dompdf/dompdf/commit/7558f07f693b2ac3266089f21051e6b78c6a0c85Patch, Third Party Advisory
• https://github.com/dompdf/dompdf/releases/tag/v2.0.2Release Notes, Third Party Advisory
• https://github.com/dompdf/dompdf/security/advisories/GHSA-3cw5-7cxw-v5qgExploit, Third Party Advisory

Published

Feb 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18…7.5
• CVE-2023-2392A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8
• CVE-2023-23920An untrusted search path vulnerability exists in Node.js. <1…4.2
• CVE-2023-23921The vulnerability was found Moodle which exists due to insuf…6.1
• CVE-2023-23922The vulnerability was found Moodle which exists due to insuf…6.1
• CVE-2023-23923The vulnerability was found Moodle which exists due to insuf…8.2
• CVE-2023-23925Switcher Client is a JavaScript SDK to work with Switcher AP…7.5
• CVE-2023-23926APOC (Awesome Procedures on Cypher) is an add-on library for…8.1
• CVE-2023-23927Craft is a platform for creating digital experiences. When y…5.4
• CVE-2023-23928reason-jose is a JOSE implementation in ReasonML and OCaml.`…9.8
• CVE-2023-23929vantage6 is a privacy preserving federated learning infrastr…8.8
• CVE-2023-2393A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8