Dompdf versions 3.15 and earlier are vulnerable to a file existence oracle discovered through manipulation of the CSS @font-face directive. By serving malicious HTML that repeatedly references local files via the file:// protocol, an attacker can cause PHP memory exhaustion: when a referenced file exists, Dompdf processes it repeatedly until the allowed memory is exceeded; if the file is missing, the request fails fast and does not trigger the memory limit. The observable difference allows attackers to enumerate sensitive files on the server, even when CHROOT restrictions apply. The resulting denial of service or data disclosure is the primary impact.

The vulnerability affects the Dompdf HTML to PDF converter for PHP. All releases up to and including 3.15 are impacted; the issue was fixed in version 3.16 and later.

The CVSS score of 2.3 classifies this as a low‑severity flaw, and an EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an application that accepts large, unsanitized HTML input for PDF rendering, a low PHP memory limit, and the ability to set the internal Dompdf warning flag to true. Attackers can launch the attack remotely by submitting crafted HTML to a vulnerable web endpoint that uses Dompdf.