CVE-2023-23924 - CVE House
Back to Database
Status published Critical CVE-2023-23924

URI validation failure on SVG parsing in Dompdf

Vulnerability Description

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23924

Credits & Attribution

No credits recorded in the NVD database.

References

More from dompdf

View All →
CVE-2024-25117
php-svg-lib lacks path validation on font through SVG inline styles
Medium 6.8
CVE-2023-50262
Dompdf possible DoS caused by infinite recursion when parsing SVG images
Medium 5.3
CVE-2023-50252
php-svg-lib unsafe attributes merge when parsing `use` tag
High 8.3
CVE-2023-50251
php-svg-lib possible DoS caused by infinite recursion when parsing SVG document
Medium 5.3
CVE-2023-24813
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
Critical 10

Affected Vendor

Affected Software

dompdf
Vulnerable Versions:
< 2.0.2

Timeline

Official Publish: January 31st, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

Weaknesses (CWE)

CWE-551

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.