CVE-2026-56722: Dompdf Path Traversal Vulnerability

CVE-2026-56722 Overview

CVE-2026-56722 is an input validation flaw ([CWE-20]) in Dompdf, an HTML-to-PDF converter for PHP. Versions 3.15 and earlier fail to enforce chroot restrictions when processing Scalable Vector Graphics (SVG) content embedded via data: URIs. An unauthenticated remote attacker who controls HTML input can bypass path restrictions and read arbitrary image files from the server file system. The maintainers fixed the issue in version 3.16.

Critical Impact
Remote, unauthenticated attackers can read arbitrary image files from the host file system by embedding crafted SVG payloads inside HTML input processed by Dompdf.

Affected Products

Dompdf versions 3.15 and prior
PHP applications integrating Dompdf for HTML-to-PDF rendering
Dompdf's bundled php-svg-lib SVG parsing dependency

Discovery Timeline

2026-07-28 - CVE-2026-56722 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-56722

Vulnerability Analysis

The flaw resides in how Dompdf processes SVG images delivered through data: URIs. Dompdf parses the SVG twice during rendering. The first pass enforces chroot-based path restrictions on external references. The second pass hands the SVG document to the separate php-svg-lib library with external references forced on.

The php-svg-lib component has no awareness of Dompdf's chroot directory. It blocks only the phar:// scheme and performs no additional path or protocol validation before reading referenced files. An attacker can embed a file path in an SVG delivered as a data: URI, and the second processing pass reads the file with no restriction.

The result is an arbitrary file read primitive limited to image content in the default configuration. Attackers can exfiltrate images stored anywhere on the host that the PHP process can access.

Root Cause

The build_url helper in src/Helpers.php did not treat data:// as a protocol requiring the same relative-path resolution logic as empty protocols. This allowed SVG-embedded references to bypass chroot enforcement. The Image/Cache.php component silently skipped unresolved references instead of rejecting them, which permitted the malformed SVG to reach php-svg-lib unchecked.

Attack Vector

An unauthenticated attacker submits HTML input containing an SVG image encoded as a data: URI. The SVG document references a target file path via an <image> or similar element. When Dompdf renders the PDF, the second parsing pass reads the referenced file and embeds its contents in the output PDF.

php

// Security patch: src/Helpers.php
// Correctly resolve local URL references from within data-URI SVG documents
public static function build_url($protocol, $host, $base_path, $url, $chrootDirs = [])
{
    $protocol = mb_strtolower($protocol, "UTF-8");
-   if (empty($protocol)) {
+   if (empty($protocol) || $protocol === "data://") {
        $protocol = "file://";
    }
    if ($url === "") {
// Source: https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0

php

// Security patch: src/Image/Cache.php
// Reject SVG whose file references do not resolve
$inner_full_url = Helpers::build_url($parsed_url["protocol"], $parsed_url["host"], $parsed_url["path"], $url, $options->getChroot());
-if (empty($inner_full_url)) {
-    continue;
+if (empty($inner_full_url)) {
+    throw new ImageException("This SVG document references a resource that could not be resolved.", E_WARNING);
}
self::detectCircularRef($full_url, $inner_full_url);
// Source: https://github.com/dompdf/dompdf/commit/bf7b02f642e26007dedc5a22b3d6e15f9931120a

Detection Methods for CVE-2026-56722

Indicators of Compromise

HTTP request bodies containing data:image/svg+xml payloads submitted to endpoints that invoke Dompdf
SVG documents containing <image> elements referencing local file paths or file:// URIs
Generated PDF outputs that unexpectedly embed image content sourced from local file system paths
Web server logs showing large or anomalous POST payloads directed at PDF generation routes

Detection Strategies

Inspect application logs for Dompdf render calls originating from untrusted user input containing base64-encoded SVG blocks
Deploy web application firewall (WAF) rules that flag SVG payloads referencing file:// protocols or absolute file paths in <image href> attributes
Monitor PHP process file access telemetry for reads to sensitive directories initiated by the web server user during PDF generation

Monitoring Recommendations

Track outbound PDF artifacts for embedded image content that does not match expected application data
Alert on Dompdf versions below 3.16 detected in software bill of materials (SBOM) scans or Composer manifests
Correlate PDF generation events with file system access patterns to identify anomalous read activity by the PHP runtime

How to Mitigate CVE-2026-56722

Immediate Actions Required

Upgrade Dompdf to version 3.16 or later using composer require dompdf/dompdf:^3.1.6
Audit application endpoints that pass user-controlled HTML to Dompdf and restrict SVG input where feasible
Review the GitHub Security Advisory GHSA-cx96-42px-69fm for full disclosure details

Patch Information

The maintainers released the fix in Dompdf v3.1.6. The patch updates build_url to treat data:// as an empty protocol and modifies Image/Cache.php to throw an ImageException when SVG references fail to resolve. Review the Helpers.php commit and Cache.php commit for implementation details.

Workarounds

Disable SVG processing in Dompdf configuration by setting isRemoteEnabled to false and rejecting SVG MIME types at the application layer
Sanitize HTML input before passing it to Dompdf, stripping <img> and <image> tags containing data:image/svg+xml payloads
Run the PHP process under a restricted user account with read access limited to directories required for legitimate application operation

bash

# Upgrade Dompdf to the patched release
composer require dompdf/dompdf:^3.1.6

# Verify installed version
composer show dompdf/dompdf | grep versions