The vulnerability arises because dompdf uses a chroot mechanism to restrict local file access, but this protection is bypassed when SVG images are embedded via data-URI. dompdf validates local file URIs correctly but does not apply these checks to SVG content decoded from data-URIs. The SVG is then processed by php-svg-lib with external references allowed, which lacks chroot enforcement and calls file_get_contents() on arbitrary paths. This allows an attacker to embed an SVG referencing any local file, causing dompdf to read and embed that file into the generated PDF, effectively leaking local files outside the chroot directory.

An unauthenticated attacker who can supply HTML input to dompdf can read arbitrary files on the server's filesystem, bypassing the chroot restriction. This can lead to disclosure of sensitive files such as private images or configuration files. The vulnerability affects the confidentiality of the server environment but does not indicate direct code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or sanitize user-supplied HTML input to prevent embedding of SVG images via data-URIs referencing local files. Consider disabling or restricting external references in SVG rendering if configurable. Monitor vendor channels for official patches or updates addressing this issue.