CVE-2023-23924

CRITICAL
Published Feb 1, 20233y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Feb 1, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-551
CWE-863 Incorrect Authorization Authorization

Affected Products 1

VendorProductVersionRange
dompdf_projectdompdf2.0.1any

References 3

  • github.com https://github.com/dompdf/dompdf/commit/7558f07f693b2ac3266089f21051e6b78c6a0c85
    PatchThird Party Advisory
  • github.com https://github.com/dompdf/dompdf/releases/tag/v2.0.2
    Release NotesThird Party Advisory
  • github.com https://github.com/dompdf/dompdf/security/advisories/GHSA-3cw5-7cxw-v5qg
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/dompdf/dompdf/commit/7558f07f693b2ac3266089f21051e6b78c6a0c85
    PatchThird Party Advisory