CVE-2026-55554: Dompdf Path Traversal Vulnerability

CVE-2026-55554 Overview

CVE-2026-55554 is a path traversal weakness in Dompdf, an HTML-to-PDF converter for PHP. The validateLocalUri() method enforces chroot boundaries using a strpos() prefix check after normalizing paths with realpath(). Because normalization strips the trailing directory separator from $chrootPath, the check only confirms that $chrootPath is a string prefix of $realfile. A chroot of /var/www therefore also matches sibling directories such as /var/www2, /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML can escape the chroot and read files outside the allowed directory. The issue affects Dompdf versions 3.1.5 and prior, and is fixed in version 3.1.6. The weakness is classified under [CWE-20] Improper Input Validation.

Critical Impact
Attackers who influence rendered HTML can read sensitive files stored in directories that share a prefix with the configured chroot.

Affected Products

Dompdf versions 3.1.5 and prior
PHP applications embedding Dompdf for server-side HTML-to-PDF conversion
Web applications exposing user-controlled HTML content to Dompdf rendering

Discovery Timeline

2026-07-28 - CVE-2026-55554 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-55554

Vulnerability Analysis

Dompdf resolves local URI references (such as images, stylesheets, and fonts) through the validateLocalUri() method. To restrict file access, the library normalizes both the requested file path and the configured chroot using realpath(), then compares them with strpos(). The comparison treats the chroot as a raw string prefix rather than a directory boundary.

Because realpath() returns paths without a trailing directory separator, /var/www is compared against absolute paths that may begin with /var/www but continue into unrelated sibling directories. Paths such as /var/www2/secrets.txt or /var/www-admin/config.php satisfy the prefix check and pass validation. The rendering engine then reads those files, exposing their contents through the generated PDF.

The attack requires the adversary to control part of the HTML input, typically through user-submitted templates, profile fields, or upstream content that reaches the Dompdf pipeline. Exploitation results in disclosure of files outside the intended chroot but does not affect integrity or availability.

Root Cause

The root cause is a missing directory-boundary check. The comparison must append a directory separator to the normalized chroot before performing the prefix match, or use a canonical containment check that treats the chroot as a directory rather than a substring.

Attack Vector

An attacker submits HTML containing crafted file:// or relative local URI references that resolve to sibling directories of the configured chroot. When the server renders the HTML with a vulnerable Dompdf version, the embedded resources are fetched and their contents are included in the resulting PDF.

The vulnerability requires user interaction to trigger the PDF generation flow and depends on filesystem layout where sensitive files live in directories sharing a prefix with the chroot. See the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4 for technical details.

Detection Methods for CVE-2026-55554

Indicators of Compromise

Generated PDFs containing contents of files from directories adjacent to the configured Dompdf chroot
Dompdf log entries or PHP file access records referencing paths outside the expected asset directory but sharing its prefix
HTML input containing local URI references (file://, src="/var/...") originating from untrusted users

Detection Strategies

Inventory PHP applications and dependencies to identify Dompdf installations at version 3.1.5 or earlier via composer.lock
Audit application code for calls to Dompdf::loadHtml() that accept user-controlled markup and review the configured chroot option
Compare filesystem layout against configured chroot values to identify sibling directories that share a prefix with the allowed path

Monitoring Recommendations

Monitor web server and PHP-FPM access logs for anomalous file reads occurring during PDF generation requests
Alert on outbound PDF responses that reference filesystem paths outside the intended asset directory
Track composer dependency updates in CI to flag continued use of Dompdf versions below 3.1.6

How to Mitigate CVE-2026-55554

Immediate Actions Required

Upgrade Dompdf to version 3.1.6 or later using composer require dompdf/dompdf:^3.1.6
Review chroot configuration and confirm no sensitive directories share a prefix with the allowed path
Restrict the source of HTML passed to Dompdf so it does not contain untrusted local URI references

Patch Information

The fix is available in Dompdf 3.1.6. See the GitHub Release v3.1.6 for the release notes and the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4 for advisory details. The patched validateLocalUri() method enforces a proper directory-boundary check.

Workarounds

Rename or relocate sensitive directories so they do not share a filename prefix with the configured chroot
Disable remote and local file access in Dompdf options (isRemoteEnabled set to false, restrictive chroot) where PDF generation does not require external resources
Sanitize HTML input to strip src, href, and CSS url() references pointing to local filesystem paths before passing content to Dompdf

bash

# Configuration example
composer require dompdf/dompdf:^3.1.6