CVE-2026-59943: 
PHP vulnerability analysis and mitigation

CVE-2026-59943 is an information disclosure vulnerability in Dompdf titled "Embedded SVG images can leak existence of files and directories within the filesystem." It affects all versions of the dompdf/dompdf Composer package prior to 3.1.6 (i.e., ≤ 3.1.5). The vulnerability was published by maintainer bsweeney on July 20, 2026, and added to the GitHub Advisory Database on July 22, 2026. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Dompdf Advisory).

The root cause is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). When Dompdf processes an HTML document containing a data-URI encoded SVG with an <image> element whose href or xlink:href attribute references a local filesystem path (e.g., file:///somepath), the library behaves differently depending on whether the referenced path exists: a non-existent path triggers a PHP Warning and Notice in SurfaceCpdf.php, while an existing path causes the image to render as empty space without errors. This behavioral difference is observable in the rendered PDF output, enabling an oracle-style enumeration of filesystem paths. The fix, applied in commit 6a58996, corrects the build_url() function in src/Helpers.php to treat data:// protocol contexts as file://, preventing improper local URL resolution from within data-URI SVG documents (Dompdf Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to confirm the existence or non-existence of arbitrary files and directories on the backend server's filesystem, constituting a filesystem oracle. There is no direct integrity or availability impact, and the vulnerability does not enable direct file content reading; however, the disclosed path information can facilitate reconnaissance for chained attacks, such as identifying configuration files, credentials, or application structure to support further exploitation (GitHub Advisory).

1. Identify target: Locate a web application that accepts user-supplied HTML or template content and uses Dompdf (≤ 3.1.5) to render it as a PDF.
2. Craft malicious SVG payload: Create an SVG document containing an <image> element with an href or xlink:href attribute pointing to a target filesystem path (e.g., file:///etc/passwd for a known path, or file:///DOESNOTEXIST for a non-existent path).
3. Encode as data-URI: Base64-encode the SVG and embed it as a data-URI within an <img> tag in an HTML document: <img src="data:image/svg+xml;base64,<BASE64_SVG>"/>.
4. Submit for rendering: Submit the crafted HTML to the target application's PDF generation endpoint.
5. Observe PDF output: Inspect the rendered PDF — a broken image icon indicates the referenced path exists on the filesystem; empty space (no error) indicates the path does not exist.
6. Enumerate filesystem: Repeat with different paths (e.g., /etc/, /var/www/html/config.php, /home/) to systematically map the server's filesystem structure (Dompdf Advisory).

• Logs: PHP error logs containing entries such as PHP Warning: file_get_contents(file:///...): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173 or PHP Notice: getimagesize(): Error reading from /tmp/svg... — repeated occurrences with varying file paths suggest active enumeration.
• Network/Application: Repeated PDF generation requests from the same source IP containing data:image/svg+xml;base64, payloads in HTML input fields, especially with systematically varying file:// URI paths in the decoded SVG content.
• File System: Temporary SVG files (e.g., /tmp/svgsk*.svg) created in rapid succession, which may indicate automated enumeration attempts (Dompdf Advisory).

Upgrade dompdf/dompdf to version 3.1.6 or later, which corrects the URL resolution logic for data-URI SVG documents. As a workaround where upgrading is not immediately possible, restrict or sanitize user-supplied HTML content before passing it to Dompdf, preventing untrusted input from reaching the SVG rendering pipeline. The Dompdf project also recommends reviewing the Securing Dompdf wiki for additional hardening guidance (Dompdf Release, Fix Commit).

The vulnerability was reported by security researcher w4tchd0ge and patched by Dompdf maintainer bsweeney as part of a broader v3.1.6 release that addressed six moderate-severity vulnerabilities simultaneously. Tenable has published a cloud security plugin (ID 445185) covering this CVE. No significant broader media coverage or notable social media discussion has been identified beyond the advisory and automated threat intelligence aggregation (Dompdf Release, GitHub Advisory).