HIGH🇵🇱 Wersja polska

CVE-2022-41343

CVSS 7.5v3.1pub. 2022-09-25upd. 2025-05-22

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Dompdf Project Dompdf

    APP
    Dompdf Project
    < 2.0.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-3838CRITICAL9.8PL ✓ten sam produkt

RCE przez PHAR deserialization w DomPDF przed wersją 2.0.0

CVE-2021-3902CRITICAL9.8PL ✓ten sam produkt

XXE w parserze SVG biblioteki dompdf umożliwia SSRF i PHAR deserialization

CVE-2023-24813CRITICAL10.0ten sam produkt

Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and...

CVE-2023-23924CRITICAL10.0ten sam produkt

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passi...

CVE-2022-28368CRITICAL9.8ten sam produkt

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Styl...