CVE-2014-2383
DOMPDF Arbitrary File Read
CVE-2014-2383 is a medium vulnerability (CVSS 6.8) in Dompdf, published April 28, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 39.4%, the 98th percentile. Fixed in dompdf/dompdf 0.6.1.
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
Exploit likelihood
What each source reports
NVD Score used
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Record
CVE-2014-2383- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Record
CVE-2014-2383- Updated
- 2026-11-02
EUVDEUVD-2022-5021 No score
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Record
EUVD-2022-5021- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qr6q-w4gj-3865 No score
DOMPDF Arbitrary File Read
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Record
GHSA-qr6q-w4gj-3865- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Record
CVE-2014-2383- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-2383 No score
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Record
DEBIAN-CVE-2014-2383- Updated
- 2026-11-02
OSVGHSA-qr6q-w4gj-3865 No score
DOMPDF Arbitrary File Read
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Record
GHSA-qr6q-w4gj-3865- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-2383 No score
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
- Record
UBUNTU-CVE-2014-2383- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dompdf/dompdfPackagist |
0.6.0 up to 0.6.1 | 0.6.1 |
php-dompdfDebian:12 |
before 0.6.1+dfsg-2 | 0.6.1+dfsg-2 |
dompdf/dompdfPackagist |
0.6.0 up to 0.6.1, plus listed versions v0.6.0 |
0.6.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | dompdf 0.6.0 - 'dompdf.php?read' Arbitrary File Read | 2014-04-24 |
| PoC in GitHub | Relativ3Pa1n/CVE-2014-2383-LFI-to-RCE-Escalation | 2023-01-26 |
| Nuclei | Dompdf < v0.6.0 - Local File Inclusion |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected, exploits | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
References
portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383
github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028
seclists.org/fulldisclosure/2014/Apr/258
securityfocus.com/archive/1/531912/100/0/threaded
explore.avertium.com/resource/lfi-rfi-escalation-to-rce
nvd.nist.gov/vuln/detail/CVE-2014-2383
Show 7 moreShow less
web.archive.org/web/20151215023329/http://www.securityfocus.com/archive/1/531912/100/0/threaded
security-tracker.debian.org/tracker/CVE-2014-2383
ubuntu.com/security/CVE-2014-2383
cve.org/CVERecord?id=CVE-2014-2383