Dompdf, an HTML to PDF converter for PHP, contains a flaw in versions 3.15 and earlier where SVG rendering can reveal the presence of files and directories on the server. When an attacker supplies a data‑URI encoded SVG that contains an <image> element with a file:// reference, Dompdf misbehaves differently for non‑existent versus existing paths. This discrepancy allows the attacker to discover whether a specified file or directory exists, thereby leaking filesystem information. The weakness is a classic information‑exposure issue, rated as CWE‑209.

The vulnerability affects the Dompdf library distributed as dompdf:dompdf for PHP. All releases up to and including version 3.15 are impacted; the bug is fixed in version 3.16.

With a CVSS score of 6.3, this issue carries a moderate severity; the EPSS score of less than 1 percent indicates a low likelihood of exploitation, and it is not listed in CISA’s KEV catalog. An attacker must be able to supply arbitrary content to Dompdf, typically via a web application that accepts user‑generated PDFs. If that content includes a malicious SVG with crafted file references, the attacker can test file names to determine existence on the server, thereby enabling further reconnaissance or credential‑guessing attacks. Because the vulnerability relies on the Dompdf library’s processing of SVG and not on privileged code execution, there is no direct remote code execution risk, but the information disclosure could aid in subsequent attacks.