Remote code injection in dompdf/dompdf

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-28368 · ADVISORY
• dompdf/dompdf · WEB
• dompdf/dompdf#2808 · WEB
• dompdf/dompdf commit 4c70e10 · WEB
• FriendsOfPHP/security-advisories · WEB
• GitHub Advisory GHSA-x752-qjv4-c4hc · ADVISORY
• dompdf/dompdf · PACKAGE
• snyk-labs/php-goof · WEB
• packagist.org/packages/dompdf/dompdf · WEB
• snyk.io/blog/security-alert-php-pdf-library-dompdf-rce · WEB
• packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html · WEB
• snyk.io/blog/security-alert-php-pdf-library-dompdf-rce

dompdf/dompdf のその他の脆弱性

• CVE-2026-59943中 5.3Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering b…
• CVE-2026-59942高 7.5Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhausti…
• CVE-2026-59941高 7.5Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its …
• CVE-2026-56722中 5.3Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction…
• CVE-2026-55555高 7.5Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulatio…