What is CVE-2026-55554?
CVE-2026-55554 is a path traversal vulnerability in Dompdf versions 3.15 and prior. It occurs because the validateLocalUri() method uses a flawed strpos() prefix check after normalizing paths with realpath(), which strips the trailing directory separator and bypasses chroot restrictions. Immediate patching or upgrade is required to prevent unauthorized file access.
Azərbaycanca: CVE-2026-55554, Dompdf-in 3.15 və əvvəlki versiyalarında aşkar edilmiş path traversal zəifliyidir. Hücumçu, validateLocalUri() metodunun realpath() ilə normallaşdırmadan sonra strpos() ilə yol prefiksini yanlış yoxlamasından istifadə edərək chroot məhdudiyyətindən yayına bilər. Təcili olaraq patching tətbiq edilməli və ya dompdf yenilənməlidir.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which versions of Dompdf are affected by CVE-2026-55554?
CVE-2026-55554 affects Dompdf versions 3.15 and prior.
How can an attacker bypass chroot restrictions in CVE-2026-55554?
The validateLocalUri() method performs an incorrect strpos() prefix check after normalizing paths with realpath(), which strips the trailing directory separator and enables bypassing chroot restrictions.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.