The vulnerability in Dompdf's validateLocalUri() method stems from improper enforcement of chroot boundaries. After normalizing file paths with realpath(), the code checks if the file path starts with the chroot path using strpos(), but does not append a trailing slash to the chroot path. This allows paths in directories with names that start with the chroot path string but are outside the intended directory (e.g., /var/www2 when chroot is /var/www) to pass the check. Consequently, attacker-controlled document paths can bypass local file restrictions and access files outside the chroot. The issue affects Dompdf versions prior to 3.1.6.

An attacker who can control part of the HTML rendered by Dompdf can bypass the intended chroot restrictions and access files outside the allowed directories. This may lead to unauthorized disclosure of sensitive local files. The severity is rated low, and there are no known exploits in the wild at this time.

A fix is available in Dompdf version 3.1.6 or later. Users should upgrade to version 3.1.6 or newer to address this vulnerability. Until patched, carefully validate and sanitize any user-controlled input that affects file paths or document content to minimize risk.