CVE-2021-3902

Published: Nov 15, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

Affected (1)

Products: Dompdf Project: Dompdf

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dompdf Project Dompdf	Before 2.0.0

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799

Source: security@huntr.dev

Patch

https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1

Source: security@huntr.dev

ExploitIssue TrackingPatchThird Party Advisory

Timeline

No history available yet.