CVE-2022-28368

CRITICAL

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 4/3/2022Modified: 11/21/2024

Related Intelligence (1)

LOWAi

Metasploit Wrap Up 05/29/2026

More Linux LPEs Hark the age of the Linux LPE has arrived. This week’s release follows up on recent work bringing new Linux LPEs to Metasploit users. Copy Fail seemed to have kicked off a trend of similar bugs and hot on its heels is Dirty Frag. Dirty Frag is actually two vulnerabilities in a trenchcoat, individually identified as CVE-2026-43284 and CVE-2026-43500. Each is exploitable individually

CVE-2026-43284CVE-2026-43500
Rapid7

References (14)

http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.htmlhttps://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141dPatchThird Party Advisoryhttps://github.com/dompdf/dompdf/issues/2598PatchThird Party Advisoryhttps://github.com/dompdf/dompdf/pull/2808PatchThird Party Advisoryhttps://github.com/snyk-labs/php-goofThird Party Advisoryhttps://packagist.org/packages/dompdf/dompdf#v1.2.1ProductThird Party Advisoryhttps://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/ExploitThird Party Advisoryhttp://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.htmlhttps://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141dPatchThird Party Advisoryhttps://github.com/dompdf/dompdf/issues/2598PatchThird Party Advisoryhttps://github.com/dompdf/dompdf/pull/2808PatchThird Party Advisoryhttps://github.com/snyk-labs/php-goofThird Party Advisoryhttps://packagist.org/packages/dompdf/dompdf#v1.2.1ProductThird Party Advisoryhttps://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/ExploitThird Party Advisory