External Control of File Name or Path in Dompdf - CVE-2022-2400
Published: February 16, 2023
Vulnerability identifier: #VU72317
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-2400
CWE-ID: CWE-73
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to view arbitrary images on the system.
The vulnerability exists due to application allows an attacker to control path of the files to include into the generated PDF output. A remote attacker can pass a specially crafted path to the application and include arbitrary images from the server into the resulting PDF file.
Affected software
Dompdf
How to mitigate CVE-2022-2400
Install updates from vendor's website.
Dompdf - update to 2.0.0