Php dompdf: Dompdf is an HTML to PDF converter for PHP. (CVE-2026-55555)
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
AI Analysis
Technical Summary
Dompdf before version 3.1.6 is susceptible to a file existence oracle attack through manipulation of the CSS @font-face directive referencing local files via file:// URLs. When processing malicious HTML input, Dompdf attempts to load local files repeatedly. If the file exists, Dompdf exhausts PHP memory limits and crashes; if not, it fails quickly without exhausting memory. This discrepancy allows attackers to enumerate sensitive files on the server by submitting crafted HTML payloads and analyzing the PDF generation outcome. Exploitation requires the ability to provide unsanitized HTML input and system conditions that allow memory exhaustion. This vulnerability leads to information disclosure by confirming file existence remotely.
Potential Impact
The vulnerability allows remote attackers to confirm the existence of sensitive local files on a server running vulnerable Dompdf versions by causing memory exhaustion errors when files exist and normal rendering when they do not. This information disclosure can aid attackers in mapping the server's file system and identifying sensitive files such as configuration files or keys. There is no direct code execution or file content disclosure, but the file existence oracle can facilitate further attacks.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, mitigate risk by sanitizing and validating all user-supplied HTML input to prevent injection of malicious CSS referencing local files. Additionally, configure PHP memory limits and Dompdf options to reduce the likelihood of memory exhaustion errors triggered by crafted inputs. Avoid allowing unrestricted HTML input to Dompdf rendering endpoints.
Php dompdf: Dompdf is an HTML to PDF converter for PHP. (CVE-2026-55555)
Description
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Dompdf before version 3.1.6 is susceptible to a file existence oracle attack through manipulation of the CSS @font-face directive referencing local files via file:// URLs. When processing malicious HTML input, Dompdf attempts to load local files repeatedly. If the file exists, Dompdf exhausts PHP memory limits and crashes; if not, it fails quickly without exhausting memory. This discrepancy allows attackers to enumerate sensitive files on the server by submitting crafted HTML payloads and analyzing the PDF generation outcome. Exploitation requires the ability to provide unsanitized HTML input and system conditions that allow memory exhaustion. This vulnerability leads to information disclosure by confirming file existence remotely.
Potential Impact
The vulnerability allows remote attackers to confirm the existence of sensitive local files on a server running vulnerable Dompdf versions by causing memory exhaustion errors when files exist and normal rendering when they do not. This information disclosure can aid attackers in mapping the server's file system and identifying sensitive files such as configuration files or keys. There is no direct code execution or file content disclosure, but the file existence oracle can facilitate further attacks.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, mitigate risk by sanitizing and validating all user-supplied HTML input to prevent injection of malicious CSS referencing local files. Additionally, configure PHP memory limits and Dompdf options to reduce the likelihood of memory exhaustion errors triggered by crafted inputs. Avoid allowing unrestricted HTML input to Dompdf rendering endpoints.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7x2p-4jvh-6384
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55555"]
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a6150ed9c2644c7f8da2c98
Added to database: 07/22/2026, 23:23:25 UTC
Last enriched: 07/22/2026, 23:40:26 UTC
Last updated: 09/05/2026, 10:52:10 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.