Dompdf allows remote file inclusion because URI validation failure does not halt font registration

HIGH 7.5CVE-2022-41343 · GHSA-6x28-7h8c-chx4 · Published 25/09/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
dompdf/dompdf Packagist	`< 2.0.1`	`2.0.1`
dompdf dompdf_project	`< 2.0.1`	`2.0.1`

Description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

NVD description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

References

nvd.nist.gov/vuln/detail/CVE-2022-41343 · ADVISORY
dompdf/dompdf · WEB
dompdf/dompdf#2995 · WEB
dompdf/dompdf commit 66431c5 · WEB
FriendsOfPHP/security-advisories · WEB
GitHub Advisory GHSA-6x28-7h8c-chx4 · ADVISORY
dompdf/dompdf · PACKAGE
dompdf/dompdf release v2.0.1 · WEB
tantosec.com/blog/cve-2022-41343 · WEB
tantosec.com/blog/cve-2022-41343 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free