CVE-2026-59943: Dompdf Information Disclosure Vulnerability

CVE-2026-59943 Overview

CVE-2026-59943 affects Dompdf, an HTML-to-PDF converter for PHP, in versions 3.1.5 and earlier. The vulnerability enables an attacker who can supply arbitrary rendering content to leak filesystem information through the SVG rendering pipeline. Attackers embed <image> elements inside a data-URI encoded SVG document and reference local files through the href or xlink:href attributes. Dompdf produces observably different behavior when the referenced path exists versus when it does not, allowing an attacker to probe the underlying filesystem. The issue is classified under [CWE-209] (Generation of Error Message Containing Sensitive Information) and is fixed in Dompdf version 3.1.6.

Critical Impact
Remote attackers can enumerate files and directories on the server hosting Dompdf without authentication, exposing sensitive filesystem layout information.

Affected Products

Dompdf versions 3.1.5 and prior
PHP applications embedding Dompdf for HTML-to-PDF rendering with untrusted input
Web services accepting user-supplied HTML or SVG content for PDF generation

Discovery Timeline

2026-07-28 - CVE-2026-59943 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-59943

Vulnerability Analysis

The vulnerability resides in Dompdf's URL resolution logic when handling SVG content delivered as a data URI. When Dompdf renders an SVG document, it processes embedded <image> elements and attempts to resolve their href or xlink:href attributes. Because the parent document is loaded through the data:// protocol, Dompdf falls back to a base protocol when resolving relative references. That fallback incorrectly resolves references such as file:///path/to/target against the local filesystem. When the target exists, Dompdf's rendering path diverges from the path taken when the file is missing, producing an observable side channel. An attacker can iterate over candidate paths and infer their existence from the response.

Root Cause

The root cause is in the build_url helper in src/Helpers.php. When the protocol is empty, Dompdf substitutes file://, but it does not treat the data:// protocol as a distinct rendering context. Nested references within a data-URI SVG therefore inherit the local filesystem protocol instead of being restricted. This produces differential behavior on existent versus non-existent paths, which maps to the [CWE-209] weakness class.

Attack Vector

Exploitation requires the attacker to supply HTML or SVG content that Dompdf will render. The attacker submits a data-URI encoded SVG containing an <image> element whose href targets a file:// path. By observing rendering output, warnings, or timing differences between existing and non-existing paths, the attacker enumerates files and directories on the server.

php

// Patch excerpt: src/Helpers.php
 public static function build_url($protocol, $host, $base_path, $url, $chrootDirs = [])
 {
     $protocol = mb_strtolower($protocol, "UTF-8");
-    if (empty($protocol)) {
+    if (empty($protocol) || $protocol === "data://") {
         $protocol = "file://";
     }
     if ($url === "") {
// Source: https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0

The fix explicitly folds the data:// protocol into the empty-protocol branch so that nested URL resolution is normalized and chroot restrictions apply consistently.

Detection Methods for CVE-2026-59943

Indicators of Compromise

Inbound HTTP requests containing data:image/svg+xml payloads with nested <image> elements referencing file:// URIs
PDF rendering jobs that include SVG content with xlink:href or href attributes pointing to absolute local paths
Repeated PDF generation requests differing only in a probed filesystem path, indicating enumeration

Detection Strategies

Inspect PDF generation input for embedded SVG containing <image> elements referencing file://, phar://, or other local pseudo-protocols
Log and review the resolved URLs passed through the Dompdf build_url helper when running in debug mode
Correlate application-layer errors or warnings from Dompdf with the source request payload to identify filesystem probing

Monitoring Recommendations

Monitor PHP error logs for file_get_contents or SVG image resolution warnings originating from Dompdf modules
Alert on high-volume PDF generation activity from a single source with varying file:// targets
Track invocations of Dompdf across application servers and flag versions at or below 3.1.5

How to Mitigate CVE-2026-59943

Immediate Actions Required

Upgrade Dompdf to version 3.1.6 or later across all applications
Audit application inputs that flow into Dompdf and reject SVG content from untrusted sources until patched
Restrict Dompdf's filesystem access using the chroot option and disable remote file access via the isRemoteEnabled setting

Patch Information

The issue is fixed in Dompdf v3.1.6. Review the GitHub Security Advisory GHSA-j8qw-6jw8-r297, the GitHub Release v3.1.6, and the upstream commit for the corrected build_url logic in src/Helpers.php.

Workarounds

Sanitize incoming HTML and SVG to strip <image> elements whose href or xlink:href attributes reference file://, phar://, or other local schemes
Configure Dompdf with chroot set to a dedicated directory containing only rendering assets
Run Dompdf under a low-privilege OS account with read access restricted to required rendering resources

bash

# Configuration example for Dompdf hardening
$options = new \Dompdf\Options();
$options->set('isRemoteEnabled', false);
$options->set('chroot', '/var/www/app/pdf-assets');
$options->set('isHtml5ParserEnabled', true);
$dompdf = new \Dompdf\Dompdf($options);