CVE Feed

    Dashboard / CVE / CVE-2021-3902

    CVE-2021-3902

    An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

    Published:Nov 15, 2024
    Last Modified:Nov 19, 2024
    EPS:Nov 15, 2024
    EPSS Score:0.04906
    CVSS Score:9.8

    Affected Products

    Vendor
    Dompdf
    Product
    Dompdf
    Vendor
    Dompdf Project
    Product
    Dompdf

    Exploits

    https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-221 Data Serialization External Entities Blowup

    Related CVEs

    CVE-2026-59941 (CVSS 6.3) — Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-com…
    CVE-2026-59942 (CVSS 6.3) — Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS…
    CVE-2026-59943 (CVSS 6.3) — Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrest…
    CVE-2026-56722 (CVSS 6.3) — Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML inp…
    CVE-2026-55554 (CVSS 2.3) — Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces…
    CVE-2026-55555 (CVSS 2.3) — Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle …
    CVE-2021-3838 (CVSS 9.8) — DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol be…
    CVE-2014-2383 (CVSS 6.8) — dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to by…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High