CVE-2026-59943: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG render

unknownCVE-2026-59943

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem. This issue has been fixed in version 3.16.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-28
Last updated: 2026-07-30
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59943

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-599430.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59943	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

mediumGHSA-j8qw-6jw8-r297: Dompdf: Embedded SVG images can leak existence of files and directories within the filesy…ghsa

Recent advisories for Dompdf is an

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-59942: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial…nvd · 2026-07-28
unknownCVE-2026-59941: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and gen…nvd · 2026-07-28
unknownCVE-2026-56722: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who contr…nvd · 2026-07-28
unknownCVE-2026-55555: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File E…nvd · 2026-07-28
unknownCVE-2026-55554: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri()…nvd · 2026-07-28
mediumGHSA-j8qw-6jw8-r297: Dompdf: Embedded SVG images can leak existence of files and directories within the filesy…ghsa · 2026-07-22