CVE-2026-59943: Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

July 22, 2026

If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document.

References

github.com/advisories/GHSA-j8qw-6jw8-r297
github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0
github.com/dompdf/dompdf/releases/tag/v3.1.6
github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297
nvd.nist.gov/vuln/detail/CVE-2026-59943

Code Behaviors & Features

Detect and mitigate CVE-2026-59943 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →