Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method     enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because     normalization strips the trailing directory separator from $chrootPath , the check only verifies that     $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like     /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could     exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has     been fixed in version 3.16. (CVE-2026-55554)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method
    enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because
    normalization strips the trailing directory separator from $chrootPath , the check only verifies that
    $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like
    /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could
    exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has
    been fixed in version 3.16. (CVE-2026-55554)

ID	Name	Product	Family	Type	Severity
330638	Linux Distros Unpatched Vulnerability : CVE-2026-55554	Nessus	Misc.	Local	low
445179	SCA: security update for dompdf/dompdf (GHSA-wvh6-f5jh-8gw4)	Tenable Cloud Security	SCA Checks	Local	low
445179	SCA: security update for dompdf/dompdf (GHSA-wvh6-f5jh-8gw4)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-55554

low

Tenable Plugins

low

low

low