Dompdf vulnerabilities

2 known vulnerabilities in Dompdf from Dompdf Project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Dompdf: Files or Directories Accessible to External Parties

  CVE-2022-41343Sep 25, 2022Dompdf ProjectEPSS 5.98%

  registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

• 9.8 Critical severity

  Dompdf: Improper Neutralization of Input During Web Page Generation

  CVE-2022-28368Apr 3, 2022Dompdf ProjectEPSS 83.9%

  Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).