How severe is CVE-2026-55554?

CVE-2026-55554 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-55554 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-55554?

CVE-2026-55554 affects Dompdf Project Dompdf. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-55554?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-55554 published?

CVE-2026-55554 was published on 2026-07-28 and last updated on 2026-08-05.

CVE-2026-55554

CVE-2026-55554 is a high-severity vulnerability in Dompdf Project Dompdf with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 2.3
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-20
Affected product: Dompdf Project Dompdf
Published: 2026-07-28
Last modified: 2026-08-05

Description

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.

Frequently asked questions

What is CVE-2026-55554?: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
How severe is CVE-2026-55554?: CVE-2026-55554 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-55554 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-55554?: CVE-2026-55554 affects Dompdf Project Dompdf. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-55554?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-55554 published?: CVE-2026-55554 was published on 2026-07-28 and last updated on 2026-08-05.

References

Affected products (1)

cpe:2.3:a:dompdf_project:dompdf:*:*:*:*:*:*:*:*

More vulnerabilities in Dompdf Project Dompdf

CVE-2023-24813 — Critical (CVSS 10.0): Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and…
CVE-2023-23924 — Critical (CVSS 10.0): Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing…
CVE-2021-3902 — Critical (CVSS 9.8): An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side…
CVE-2021-3838 — Critical (CVSS 9.8): DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before…
CVE-2022-28368 — Critical (CVSS 9.8): Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets…
CVE-2014-5013 — High (CVSS 8.8): DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.

All CVEs affecting Dompdf Project Dompdf →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48056 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0…
CVE-2026-33267 — Critical (CVSS 10.0): Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0…
CVE-2026-47668 — Critical (CVSS 10.0): DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST…
CVE-2026-16117 — Critical (CVSS 10.0): Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix…
CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →