CVE-2026-55554— dompdf 输入验证错误漏洞

Dompdf: Chroot Validation Bypass

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with  realpath() . Because normalization strips the trailing directory separator from  $chrootPath , the check only verifies that  $chrootPath  is a string prefix of $realfile, so a chroot of  /var/www  also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

输入验证不恰当

dompdf 输入验证错误漏洞

dompdf是dompdf团队开源的一个 HTML 到 PDF 的转换器。 dompdf 3.1.6之前版本存在输入验证错误漏洞，该漏洞源于validateLocalUri()方法对chroot边界检查不足，由于路径规范化移除尾部斜杠导致前缀匹配绕过，允许攻击者读取允许目录外的敏感文件。

N/A

N/A