GHSA-j8qw-6jw8-r297 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

• Packagist dompdf/dompdf: < 3.1.6 → fixed in 3.1.6

Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Details Using an `` element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the `href` or `xlink:href` attributes. When processing a file that does not exist (e.g. `file:///DOESNOTEXIST`), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. ``` [Wed May 20 19:49:53 2026] PHP Warning: file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173 [Wed May 20 19:49:53 2026] PHP Notice: getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196 ``` PoC First, the attacker renders this HTML document: ``` Hello World! ``` The `` tag contains the following SVG content: ```xml ``` As expected, the resulting PDF contains a broken image: However, when supplying a path to a file or directory that does not exist, for example: ```xml ``` The resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the "Hello World!" text 180 degrees from the expected position: Impact By exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem.