CVE-2014-2383
NoneCVSS
—
EPSS
39.4%
Published
Apr 28, 2014
CISA due date
—
The record
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | dompdf/dompdf | 0.6.0 | 0.6.1 |
| Debian:10 | php-dompdf | 0 | 0.6.1+dfsg-2 |
| Debian:11 | php-dompdf | 0 | 0.6.1+dfsg-2 |
| Debian:12 | php-dompdf | 0 | 0.6.1+dfsg-2 |
| Debian:13 | php-dompdf | 0 | 0.6.1+dfsg-2 |
| Ubuntu:16.04:LTS | php-dompdf | 0 | 0.6.1+dfsg-2 |
Related vulnerabilities
- CVE-2021-3838 [Unknown description] Also affects dompdf/dompdf
- CVE-2014-5011 DOMPDF before 0.6.2 allows Information Disclosure. Also affects dompdf/dompdf
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
- CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-200
- CVE-2026-109259 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory… CWE-200