# CVE-2026-59943: Dompdf information disclosure via SVG image references

Source: https://junglewise.ai/threats/cve-2026-59943-dompdf-information-disclosure-via-svg-image-references  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-59943 · Severity: medium · CVSS 4 · Published 2026-07-28

Dompdf, a library used to convert HTML content into PDF documents, contains a vulnerability that allows an attacker to probe the server's filesystem. By submitting specially crafted SVG images, a malicious actor can determine whether specific files or directories exist on the underlying server. This could allow an attacker to map out the server's internal structure, potentially aiding in further, more targeted attacks.

Technologies: [Dompdf](https://junglewise.ai/threats/technologies/dompdf), [dompdf/dompdf (Packagist)](https://junglewise.ai/threats/technologies/dompdf-dompdf). Vendors: [Dompdf](https://junglewise.ai/threats/vendors/dompdf), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-59943 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59943 being exploited in the wild.

**How severe is CVE-2026-59943?** Medium severity, with a CVSS score of 4, published 28 July 2026.

**Which products and versions are affected?** Dompdf < 3.1.6, <= 3.1.5; dompdf/dompdf (Packagist) < 3.1.6, ECOSYSTEM:introduced=0,fixed=3.1.6.

**Is there a fix for CVE-2026-59943?** Yes. dompdf/dompdf (Packagist): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59943 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59943?** Check whether you run Dompdf or dompdf/dompdf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dompdf/dompdf (Packagist): upgrade to 3.1.6 or later

  ```sh
  composer require dompdf/dompdf:^3.1.6
  ```


## Technical details

An information disclosure vulnerability exists in Dompdf (versions 3.1.5 and prior) due to improper handling of SVG `<image>` elements within data-URI encoded documents. When Dompdf renders a PDF containing a malicious SVG, an attacker can use the `href` or `xlink:href` attributes to reference local files (e.g., `file:///etc/passwd`). The library exhibits different behavioral outputs (such as specific PHP warnings or rendering differences) when a file exists versus when it does not. This 'oracle' allows an unauthenticated remote attacker to confirm the existence of sensitive files and directories on the backend filesystem. The issue is addressed in version 3.1.6 by improving how local URL references are resolved within data-URI SVG documents.

## Affected products

- dompdf dompdf <= 3.1.5

## Identifiers

- CVE-2026-59943
- GHSA-j8qw-6jw8-r297

## Timeline

- 2026-07-20: patched: Fixed in version 3.1.6
- 2026-07-28: advisory: GitHub Security Advisory published

## References

- [https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0](https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0)
- [https://github.com/dompdf/dompdf/releases/tag/v3.1.6](https://github.com/dompdf/dompdf/releases/tag/v3.1.6)
- [https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297](https://github.com/dompdf/dompdf/security/advisories/GHSA-j8qw-6jw8-r297)

## Related threats

- [Dompdf resource exhaustion Denial of Service via oversized images](https://junglewise.ai/threats/cve-2026-59942-dompdf-resource-exhaustion-denial-of-service-via-oversized-images)
- [Dompdf uncontrolled resource consumption in BMP processing](https://junglewise.ai/threats/cve-2026-59941-dompdf-uncontrolled-resource-consumption-in-bmp-processing)
- [Dompdf local file read via SVG data-URI bypass](https://junglewise.ai/threats/cve-2026-56722-dompdf-local-file-read-via-svg-data-uri-bypass)
- [Dompdf file existence oracle in CSS @font-face directive](https://junglewise.ai/threats/cve-2026-55555-dompdf-file-existence-oracle-in-css-font-face-directive)
- [Dompdf chroot validation bypass in validateLocalUri](https://junglewise.ai/threats/cve-2026-55554-dompdf-chroot-validation-bypass-in-validatelocaluri)