The flaw lies in the validateLocalUri() method of the Dompdf HTML to PDF converter, which incorrectly checks chroot boundaries by using a prefix comparison after path normalization. Because the trailing directory separator is removed during realpath() resolution, the check accepts sibling directories such as /var/www2 or /var/www-admin as if they were inside /var/www. An attacker who can embed HTML that is processed by Dompdf can therefore load files outside the intended chroot, reading sensitive server data. This is a classic unchecked input weakness classified as CWE‑20, leading to a confidentiality breach.

The vulnerability affects the Dompdf library version 3.15 and earlier, as used in PHP applications that generate PDFs from user‑supplied HTML. All deployments of these versions that rely on the validateLocalUri() check are potentially impacted; the issue was fixed in release 3.16.

The CVSS score of 2.3 indicates a low severity, and the EPSS score of less than 1 % suggests a minimal likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation would require the attacker to supply HTML input that is rendered by Dompdf, so it is limited to environments where user content is trusted or not properly sanitised. In such contexts, the vulnerability could allow a local attacker to read arbitrary files inside the server filesystem beyond the configured chroot.