Information disclosure in Dompdf - CVE-2026-59943
Published: July 20, 2026
Vulnerability identifier: #VU138587
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59943
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in embedded SVG image handling when rendering documents containing crafted SVG content. A remote attacker can embed references to filesystem paths in an SVG image to disclose sensitive information.
The issue can reveal the existence of files and directories on the underlying filesystem.
Affected software
Dompdf
How to mitigate CVE-2026-59943
Install security update from vendor's website.
Dompdf - update to 3.1.6