CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

82.85% chance of exploitation in the next 30 days, 100th percentile

Published

2022-04-03

Updated

2024-08-03

Proof-of-concept exploits (4)

• Henryisnotavailable/Dompdf-Exploit-RCE0★ · 2023-05-07
• That-Guy-Steve/CVE-2022-28368-handler0★ · 2023-04-28
• rvizx/CVE-2022-2836816★ · 2024-01-19
• rvzsec/CVE-2022-2836816★ · 2024-01-19

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/dompdf_rce_cve_2022_2…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51270

Security advisories

• dompdf/dompdf/pull/2808
• snyk-labs/php-goof
• https://packagist.org/packages/dompdf/dompdf#v1.2.1
• https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce
• advisories/GHSA-x752-qjv4-c4hc

References

• CVE Record
• NVD entry

Related

• CVE-2018-16858
• CVE-2025-27581
• CVE-2018-1133
• CVE-2016-10924
• CVE-2021-4034
• CVE-2023-26035