CVE-2022-28368

    Dashboard / Vulnerabilities / CVE-2022-28368

    CVE-2022-28368

    Published: 3 Apr 2022Last Modified: 12 Aug 2026

    Summary:

    Details: Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

    References: http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html, https://packagist.org/packages/dompdf/dompdf#v1.2.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28368.json, https://nvd.nist.gov/vuln/detail/CVE-2022-28368, https://github.com/dompdf/dompdf/issues/2598, https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d, https://github.com/dompdf/dompdf/pull/2808, https://github.com/snyk-labs/php-goof, https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c6dfd9bb8b0040609f04754f729d4cb3016e0575

    Affected versions

    v1.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-28368 | CVE-DB