CVE-2026-55554

NameCVE-2026-55554
DescriptionDompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with  realpath() . Because normalization strips the trailing directory separator from  $chrootPath , the check only verifies that  $chrootPath  is a string prefix of $realfile, so a chroot of  /var/www  also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1142987

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
php-dompdf (PTS)bullseye0.6.2+dfsg-3.1vulnerable
bullseye (security)0.6.2+dfsg-3.1+deb11u1vulnerable
bookworm2.0.3+dfsg-1+deb12u1vulnerable
sid3.1.4+dfsg-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php-dompdfsource(unstable)(unfixed)1142987

Notes

https://github.com/dompdf/dompdf/security/advisories/GHSA-wvh6-f5jh-8gw4

Search for package or bug name: Reporting problems