CVE-2026-55554: Dompdf Chroot Validation Bypass Vulnerability
Summary
CVE-2026-55554: Dompdf: Chroot Validation Bypass. Affects dompdf/dompdf versions < 3.1.6. Fixed in 3.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dompdf is a popular open-source PHP library that enables the generation of PDF documents from HTML content. It is widely used in web applications to create dynamic PDF files. The library provides features such as CSS styling, image embedding, and font management. However, a vulnerability has been identified in its chroot validation mechanism, which could allow unauthorized access to files outside the intended directory structure.
Vulnerability Detail
The vulnerability arises from the validateLocalUri() method, which is responsible for checking if a local file is within an allowed chroot directory. The method uses a string prefix check with strpos() after normalizing the file path with realpath(). Due to the absence of a terminating directory separator in the chroot path, this check can be bypassed. An attacker can exploit this flaw by crafting a document path that appears to be within the allowed chroot but actually points to a different directory. This could lead to unauthorized access to sensitive files, posing a significant security risk.
How To Fix
Minimum fixed version
3.1.6
This is the first release that contains the fix.
composer require dompdf/dompdf:3.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your code to validate file paths before passing them to Dompdf. For example, ensure that the file paths do not contain any unexpected directory traversal sequences or validate the paths against a whitelist of allowed directories.
Conclusion
The Dompdf chroot validation bypass vulnerability (CVE-2026-55554) poses a risk of unauthorized file access. It is crucial for users of the Dompdf library to update to version 3.1.6 or later to mitigate this risk. Implementing additional validation checks can also help protect against potential exploitation until the package is updated.
See every vulnerability recorded for dompdf/dompdf →
FAQ
An attacker could bypass chroot restrictions and access sensitive files outside the allowed directories, potentially leading to data exposure.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
Yes, a patch is available in version 3.1.6 of the Dompdf package. Updating to this version will resolve the issue.
If immediate updates are not possible, consider implementing additional file path validation in your application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
