Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML     input can bypass this restriction by embedding a target file path inside an SVG image delivered through a     data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same     protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with     external references forced on, and that library has no knowledge of the chroot directory, blocks only the     phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an     external, unauthenticated attacker read arbitrary image files from the server's file system in the default     configuration. This issue has been fixed in version 3.16. (CVE-2026-56722)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML
    input can bypass this restriction by embedding a target file path inside an SVG image delivered through a
    data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same
    protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with
    external references forced on, and that library has no knowledge of the chroot directory, blocks only the
    phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an
    external, unauthenticated attacker read arbitrary image files from the server's file system in the default
    configuration. This issue has been fixed in version 3.16. (CVE-2026-56722)

ID	Name	Product	Family	Type	Severity
330632	Linux Distros Unpatched Vulnerability : CVE-2026-56722	Nessus	Misc.	Local	medium
445205	SCA: security update for dompdf/dompdf (GHSA-cx96-42px-69fm)	Tenable Cloud Security	SCA Checks	Local	medium
445205	SCA: security update for dompdf/dompdf (GHSA-cx96-42px-69fm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-56722

medium

Tenable Plugins

medium

medium

medium