DEBIAN-CVE-2026-55554
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
DEBIAN-CVE-2026-55554
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-55554
php-dompdf
Source reference: /affected/0/package/name
- Affected versions
- 2.0.3+dfsg-1
Source reference:
/affected/0/versions2.0.3+dfsg-1+deb12u1Source reference:
/affected/0/versions2.0.3+dfsg-2Source reference:
/affected/0/versions2.0.3+dfsg-3Source reference:
/affected/0/versions2.0.3+dfsg-4Source reference:
/affected/0/versions2.0.4+dfsg-1Source reference:
/affected/0/versions2.0.4+dfsg-2Source reference:
/affected/0/versions2.0.7+dfsg-1Source reference:
/affected/0/versions3.0.0+dfsg-1Source reference:
/affected/0/versions3.0.0+dfsg-2Source reference:
/affected/0/versions3.0.1+dfsg-1Source reference:
/affected/0/versions3.0.2+dfsg-1Source reference:
/affected/0/versions3.1.0+dfsg-1Source reference:
/affected/0/versions3.1.4+dfsg-1Source reference:
/affected/0/versions3.1.4+dfsg-2Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-dompdf",
"purl": "pkg:deb/debian/php-dompdf?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.0.3+dfsg-1",
"2.0.3+dfsg-1+deb12u1",
"2.0.3+dfsg-2",
"2.0.3+dfsg-3",
"2.0.3+dfsg-4",
"2.0.4+dfsg-1",
"2.0.4+dfsg-2",
"2.0.7+dfsg-1",
"3.0.0+dfsg-1",
"3.0.0+dfsg-2",
"3.0.1+dfsg-1",
"3.0.2+dfsg-1",
"3.1.0+dfsg-1",
"3.1.4+dfsg-1",
"3.1.4+dfsg-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55554.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57843 · Revision 1
- Added to Heist Feed
- Publisher date