Code Injection in Dompdf - CVE-2022-28368
Published: February 16, 2023 / Updated: May 21, 2026
Vulnerability identifier: #VU72315
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-28368
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation when handling "src:url" field of an @font-face Cascading Style Sheets (CSS) statement inside an HTML input file. A remote attacker can link a malicious .php file and execute it on the system with installed Dompd when converting HTML to PDF.
Successful exploitation of the vulnerability can allow an attacker to compromise the affected system.
Affected software
Dompdf
How to mitigate CVE-2022-28368
Install updates from vendor's website.
Dompdf - update to 1.2.1
Links to Public Exploits and PoC-codes
- Exploit #12717 - Dompdf RCE via Malicious Font Caching (CVE-2022-28368) (May 21, 2026)
- Exploit #10693 - Dompdf 1.2.1 - Remote Code Execution (RCE) (October 25, 2024)
- Exploit #9042 - Dompdf-Exploit-RCE (An exploit script for CVE-2022-28368 designed to make exploitation less annoying, made for a HTB machine) (May 7, 2023)
- Exploit #9015 - CVE-2022-28368-handler (This repository contains a python script that will handle the majority of the dompdf cached font exploit (CVE-2022-28368), all you need to do is create the request) (April 28, 2023)
- Exploit #8843 - CVE-2022-28368 (Dompdf RCE PoC Exploit - CVE-2022-28368) (February 16, 2023)