CVE-2021-3902 — Vulnerability in dompdf/dompdf — CVE Details

CRITICAL

Improper Restriction of XML External Entity Reference in dompdf/dompdf

Published November 15, 2024Updated November 18, 2024Source: osv

Summary

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

Advisory Timeline

First published November 15, 2024 (696 days ago).
Last revised November 18, 2024 — 3 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer

Update dompdf/dompdf to 2.0.0 or later

composer require "dompdf/dompdf:^2.0.0"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

Package	Ecosystem	Affected	Fixed In
dompdf/dompdf	packagist	v0.6.0, v0.6.1, v0.6.2, v0.7.0 (+18 more)	2.0.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-611
XML External Entity (XXE)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2021-3902?: Improper Restriction of XML External Entity Reference in dompdf/dompdf This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2021-3902?: CVE-2021-3902 affects dompdf/dompdf. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2021-3902 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-3vjh-xrhf-v9xh

Related CVEs

CVE-2023-23924
CRITICAL
Dompdf vulnerable to URI validation failure on SVG parsing
CVE-2023-24813
CRITICAL
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
CVE-2021-3838
CRITICAL
Deserialization of Untrusted Data in dompdf/dompdf
CVE-2026-107845
CRITICAL
Contao: Cross-site scripting in the comments bundle
CVE-2026-92161
CRITICAL
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies