CVE-2026-56722

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a  data:  URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate  php-svg-lib  library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the  phar://  scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.

• CWE-20

• https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0Patch
• https://github.com/dompdf/dompdf/commit/bf7b02f642e26007dedc5a22b3d6e15f9931120aPatch
• https://github.com/dompdf/dompdf/releases/tag/v3.1.6Release Notes
• https://github.com/dompdf/dompdf/security/advisories/GHSA-cx96-42px-69fmExploit, Vendor Advisory
• https://github.com/dompdf/dompdf/security/advisories/GHSA-cx96-42px-69fmExploit, Vendor Advisory

Published

Jul 28, 2026

Last Modified

Aug 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56700Grav CMS before 2.0.0-beta.2 contains multiple code-executio…9.8
• CVE-2026-56701Grav before 2.0.0-beta.2 contains an XML external entity inj…7.1
• CVE-2026-5671A vulnerability was determined in Cyber-III Student-Manageme…4.3
• CVE-2026-5672A vulnerability has been found in code-projects Simple IT Di…7.3
• CVE-2026-56720CamaleonCMS version 2.9.2 and earlier contains a missing aut…5.3
• CVE-2026-56721CamaleonCMS version 2.9.2 and earlier contains a privilege e…8.8
• CVE-2026-5673A flaw was found in libtheora. This heap-based out-of-bounds…7.1
• CVE-2026-5674A flaw was found in PipeWire, a multimedia server. This vuln…8.8
• CVE-2026-56740JLine is a Java library for handling console input. Prior to…7.5
• CVE-2026-56741JLine is a Java library for handling console input. Prior to…7.5
• CVE-2026-56742Cilium is a networking, observability, and security solution…8.9
• CVE-2026-56743Cilium is a networking, observability, and security solution…5.4