ubuntu-cve-2026-55554
Vulnerability from osv_ubuntu
Published
2026-07-30 00:00
Modified
2026-07-30 00:00
Summary
Details

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with  realpath() . Because normalization strips the trailing directory separator from  $chrootPath , the check only verifies that  $chrootPath  is a string prefix of $realfile, so a chroot of  /var/www  also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.

Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
N/A (UNKNOWN)
medium
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-dompdf",
            "binary_version": "0.6.1+dfsg-2ubuntu1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "php-dompdf",
        "purl": "pkg:deb/ubuntu/php-dompdf@0.6.1+dfsg-2ubuntu1+esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.6.1+dfsg-2",
        "0.6.1+dfsg-2build1",
        "0.6.1+dfsg-2ubuntu1",
        "0.6.1+dfsg-2ubuntu1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-dompdf",
            "binary_version": "0.6.2+dfsg-3ubuntu0.18.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "php-dompdf",
        "purl": "pkg:deb/ubuntu/php-dompdf@0.6.2+dfsg-3ubuntu0.18.04.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.6.2+dfsg-3",
        "0.6.2+dfsg-3ubuntu0.18.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-dompdf",
            "binary_version": "0.6.2+dfsg-3ubuntu0.20.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "php-dompdf",
        "purl": "pkg:deb/ubuntu/php-dompdf@0.6.2+dfsg-3ubuntu0.20.04.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.6.2+dfsg-3",
        "0.6.2+dfsg-3ubuntu0.20.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-dompdf",
            "binary_version": "0.6.2+dfsg-3.1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "php-dompdf",
        "purl": "pkg:deb/ubuntu/php-dompdf@0.6.2+dfsg-3.1ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.6.2+dfsg-3.1",
        "0.6.2+dfsg-3.1ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the\u00a0validateLocalUri()\u00a0method enforces chroot boundaries with a\u00a0strpos() prefix check after normalizing paths with \u00a0realpath()\u00a0. Because normalization strips the trailing directory separator from \u00a0$chrootPath\u00a0, the check only verifies that \u00a0$chrootPath\u00a0 is a string prefix of\u00a0$realfile, so a chroot of \u00a0/var/www\u00a0 also matches sibling directories like /var/www2\u00a0, /var/www-admin, or\u00a0/var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.",
  "id": "UBUNTU-CVE-2026-55554",
  "modified": "2026-07-30T00:00:00Z",
  "published": "2026-07-30T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-55554"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55554"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-wvh6-f5jh-8gw4"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/dompdf/dompdf/releases/tag/v3.1.6"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-55554"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.