Dompdf Project vulnerabilities
We track 2 vulnerabilities in Dompdf Project products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 25, 2022.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Dompdf Project vulnerabilities
- 7.5 High severity
Dompdf: Files or Directories Accessible to External Parties
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
- 9.8 Critical severity
Dompdf: Improper Neutralization of Input During Web Page Generation
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).