CVE-2021-3838 json
PHAR Deserialization in dompdf/dompdf
published 2024-11-15 23 mo ago modified 2026-06-17 4 mo ago also GHSA-577p-7j7h-2jgf , EUVD-2024-3197
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
Patch / fix
- packagist dompdf/dompdf 2.0.0
- dompdf dompdf/dompdf 2.0.0
- dompdf dompdf 2.0.0
- php-dompdf Debian 12 2.0.2+dfsg-1
debian advisories DEBIAN-CVE-2021-3838
- php-dompdf Ubuntu 20.04 LTS 0.6.2+dfsg-3ubuntu0.20.04.1
- php-dompdf Ubuntu 22.04 LTS 0.6.2+dfsg-3.1ubuntu0.1
- php-dompdf Ubuntu Pro 16.04 LTS 0.6.1+dfsg-2ubuntu1+esm1
- php-dompdf Ubuntu Pro 18.04 LTS 0.6.2+dfsg-3ubuntu0.18.04.1~esm1
ubuntu advisories UBUNTU-CVE-2021-3838
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
1.43% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | dompdf/dompdf | <2.0.0 |
2.0.0 |
Affected products
- dompdf dompdf/dompdf
- dompdf dompdf
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
web, patch
-
huntr.com
/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
web, exploit, issue-tracking, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-3838
advisory
-
github.com
/dompdf/dompdf
package
Sources
- CVE List CVE-2021-3838
- GitHub Advisory GHSA-577p-7j7h-2jgf
- NVD CVE-2021-3838
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.