Remote code injection in dompdf/dompdf

CRITICAL 9.8CVE-2022-28368 · GHSA-x752-qjv4-c4hc · Published 03/04/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
dompdf/dompdf Packagist	`< 1.2.1`	`1.2.1`
dompdf dompdf_project	`< 1.2.1`	`1.2.1`

Description

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

NVD description

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

References

nvd.nist.gov/vuln/detail/CVE-2022-28368 · ADVISORY
dompdf/dompdf · WEB
dompdf/dompdf#2808 · WEB
dompdf/dompdf commit 4c70e10 · WEB
FriendsOfPHP/security-advisories · WEB
GitHub Advisory GHSA-x752-qjv4-c4hc · ADVISORY
dompdf/dompdf · PACKAGE
snyk-labs/php-goof · WEB
packagist.org/packages/dompdf/dompdf · WEB
snyk.io/blog/security-alert-php-pdf-library-dompdf-rce · WEB
packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html · WEB
snyk.io/blog/security-alert-php-pdf-library-dompdf-rce · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free