CVE-2021-3902

unknown

Published 2024-11-15 · Modified 2024-11-18

CVSS v3

—

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

—

VIR risk

—

Description

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2021-3902

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`2.0.2+dfsg-1`
debian	bullseye	fixed	`0`
debian	sid	fixed	`2.0.2+dfsg-1`

Package impact

Ecosystem	Package	Vulnerable	Fixed
Packagist	dompdf/dompdf	`<2.0.0`	`2.0.0`

References

Verify integrity in audit chain (admin only). AS-IS.