Dompdf allows remote file inclusion because URI validation failure does not halt font registration

高危 7.5CVE-2022-41343 · GHSA-6x28-7h8c-chx4 · Published 25/09/2022 · updated 17/06/2026

要点

CVE-2022-41343 是影响 dompdf/dompdf, dompdf (dompdf project) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：6.0%，高于 93.3% 的漏洞。
修复：升级到 2.0.1 或更高版本。

Package	Affected versions	Patched versions
dompdf/dompdf Packagist	`< 2.0.1`	`2.0.1`
dompdf dompdf_project	`< 2.0.1`	`2.0.1`

Description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

NVD description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

References

nvd.nist.gov/vuln/detail/CVE-2022-41343 · ADVISORY
dompdf/dompdf · WEB
dompdf/dompdf#2995 · WEB
dompdf/dompdf commit 66431c5 · WEB
FriendsOfPHP/security-advisories · WEB
GitHub Advisory GHSA-6x28-7h8c-chx4 · ADVISORY
dompdf/dompdf · PACKAGE
dompdf/dompdf release v2.0.1 · WEB
tantosec.com/blog/cve-2022-41343 · WEB
tantosec.com/blog/cve-2022-41343 · Exploit

dompdf/dompdf 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dompdf/dompdf

Packagist

< 2.0.1

2.0.1

dompdf

dompdf_project

< 2.0.1

2.0.1

Description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

NVD description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

dompdf/dompdf 的其他漏洞

查看全部 →