GCVE - cpe:2.3:a:dompdf:dompdf/dompdf:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:dompdf:dompdf/dompdf:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Dompdf (`84f6aade-1b95-5ada-b4cd-20e8f3848929`)
Product	Dompdf/Dompdf (`2e7ddf06-f895-5f2a-a9b2-1e8928004c14`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-2400`	vulnerable	2026-06-08 05:43:35.471427	External Control of File Name or Path in dompdf/dompdf MEDIUM (5.3) External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0. Published: 2022-07-18T00:00:00.000Z Updated: 2024-08-03T00:39:06.372Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/a6da5e5e-86be-499a-a3c3-2950f749202a https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a https://lists.debian.org/debian-lts-announce/2023/07/msg00017.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0085`	vulnerable	2026-06-08 05:39:09.218448	Server-Side Request Forgery (SSRF) in dompdf/dompdf LOW (3.7) Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0. Published: 2022-06-28T15:00:15.000Z Updated: 2024-08-02T23:18:41.571Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236 https://github.com/dompdf/dompdf/commit/bb1ef65011a14730b7cfbe73506b4bb8a03704bd	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-3902`	vulnerable	2026-06-08 05:33:54.495407	Improper Restriction of XML External Entity Reference in dompdf/dompdf CRITICAL (9.8) An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks. Published: 2024-11-15T10:52:10.986Z Updated: 2024-11-18T14:35:29.986Z Open on db.gcve.eu Reference links https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1 https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-3838`	vulnerable	2026-06-08 05:33:54.406132	PHAR Deserialization in dompdf/dompdf CRITICAL (9.8) DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code. Published: 2024-11-15T10:51:36.766Z Updated: 2024-11-18T14:41:07.247Z Open on db.gcve.eu Reference links https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.