Dompdf, an HTML to PDF converter for PHP, contains a flaw that allows an attacker who can supply input HTML to read arbitrary files from the server’s filesystem. The vulnerability arises when an SVG image is supplied via a data: URI. Dompdf processes the SVG twice; the second pass does not enforce the same file‑path validation as the first. The separate php-svg-lib library invoked during rendering has no awareness of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file without path or protocol validation. This enables an unauthenticated attacker to read any image file that the web process can access, potentially exposing sensitive information or compromising the environment. The flaw has been fixed in version 3.16.

The issue affects the Dompdf library version 3.15 and earlier. The specific product is Dompdf (dompdf:dompdf) used in PHP applications that generate PDFs from HTML. The vulnerability is present until Dompdf 3.16, which includes the fix. No other vendors are listed.

The CVSS score of 6.3 indicates a medium severity local file read that could be leveraged for information disclosure. The EPSS score is below 1 %, implying very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious or tampered HTML document sent to an application using Dompdf to generate PDFs, where the attacker embeds a data‑URI SVG pointing at a local file. The vulnerability can be exploited without authentication if the application renders user‑controlled HTML; if the application only processes trusted content the risk is mitigated.