Is CVE-2026-59943 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59943 being exploited in the wild.

How severe is CVE-2026-59943?

Medium severity, with a CVSS score of 4, published 28 July 2026.

Which products and versions are affected?

Dompdf < 3.1.6, <= 3.1.5; dompdf/dompdf (Packagist) < 3.1.6, ECOSYSTEM:introduced=0,fixed=3.1.6.

Is there a fix for CVE-2026-59943?

Yes. dompdf/dompdf (Packagist): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59943 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59943?

Check whether you run Dompdf or dompdf/dompdf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59943: Dompdf information disclosure via SVG image references

Q: Which products and versions are affected?

Dompdf < 3.1.6, <= 3.1.5; dompdf/dompdf (Packagist) < 3.1.6, ECOSYSTEM:introduced=0,fixed=3.1.6.

Q: Is there a fix for CVE-2026-59943?

Yes. dompdf/dompdf (Packagist): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59943 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59943?

Check whether you run Dompdf or dompdf/dompdf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59943 · Severity: medium · CVSS 4 · Published 2026-07-28

Dompdf, a library used to convert HTML content into PDF documents, contains a vulnerability that allows an attacker to probe the server's filesystem. By submitting specially crafted SVG images, a malicious actor can determine whether specific files or directories exist on the underlying server. This could allow an attacker to map out the server's internal structure, potentially aiding in further, more targeted attacks.

Technologies: Dompdf, dompdf/dompdf (Packagist). Vendors: Dompdf, Packagist.

Quick answers

Is CVE-2026-59943 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59943 being exploited in the wild.
How severe is CVE-2026-59943?: Medium severity, with a CVSS score of 4, published 28 July 2026.
Which products and versions are affected?: Dompdf < 3.1.6, <= 3.1.5; dompdf/dompdf (Packagist) < 3.1.6, ECOSYSTEM:introduced=0,fixed=3.1.6.
Is there a fix for CVE-2026-59943?: Yes. dompdf/dompdf (Packagist): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59943 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59943?: Check whether you run Dompdf or dompdf/dompdf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dompdf/dompdf (Packagist): upgrade to 3.1.6 or later
```
composer require dompdf/dompdf:^3.1.6
```

Technical details

An information disclosure vulnerability exists in Dompdf (versions 3.1.5 and prior) due to improper handling of SVG `<image>` elements within data-URI encoded documents. When Dompdf renders a PDF containing a malicious SVG, an attacker can use the `href` or `xlink:href` attributes to reference local files (e.g., `file:///etc/passwd`). The library exhibits different behavioral outputs (such as specific PHP warnings or rendering differences) when a file exists versus when it does not. This 'oracle' allows an unauthenticated remote attacker to confirm the existence of sensitive files and directories on the backend filesystem. The issue is addressed in version 3.1.6 by improving how local URL references are resolved within data-URI SVG documents.

Affected products

dompdf dompdf <= 3.1.5

Identifiers

CVE-2026-59943
GHSA-j8qw-6jw8-r297

Timeline

2026-07-20: patched: Fixed in version 3.1.6
2026-07-28: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.