CVE-2014-5011

DOMPDF Information Disclosure

6.5 MediumFix available

DOMPDF before 0.6.2 allows Information Disclosure.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.49%Up 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

DOMPDF before 0.6.2 allows Information Disclosure.

Record: CVE-2014-5011
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

DOMPDF before 0.6.2 allows Information Disclosure.

Record: CVE-2014-5011
Updated: 2026-11-02

EUVDEUVD-2022-4444 No score

DOMPDF before 0.6.2 allows Information Disclosure.

Record: EUVD-2022-4444
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jwf8-mjj8-r8hq 6.5

DOMPDF Information Disclosure

DOMPDF before 0.6.2 allows Information Disclosure.

Record: GHSA-jwf8-mjj8-r8hq
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV 6.5

DOMPDF before 0.6.2 allows Information Disclosure.

Record: CVE-2014-5011
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-5011 6.5

DOMPDF before 0.6.2 allows Information Disclosure.

Record: DEBIAN-CVE-2014-5011
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-jwf8-mjj8-r8hq 6.5

DOMPDF Information Disclosure

DOMPDF before 0.6.2 allows Information Disclosure.

Record: GHSA-jwf8-mjj8-r8hq
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-5011 6.5

DOMPDF before 0.6.2 allows Information Disclosure.

Record: UBUNTU-CVE-2014-5011
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUSN-6277-1 No score

php-dompdf vulnerabilities

It was discovered that Dompdf was not properly validating untrusted input when processing HTML content under certain circumstances. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2014-5011, CVE-2014-5012, CVE-2014-5013)

It was discovered that Dompdf was not properly validating processed HTML content that referenced PHAR files, which could result in the deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-3838)

It was discovered that Dompdf was not properly validating processed HTML content that referenced both a remote base and a local file, which could result in the bypass of a chroot check. An attacker could possibly use this issue to expose sensitive information. (CVE-2022-2400)

Record: USN-6277-1
Updated: 2026-11-02

Affected products

dompdf project dompdf

Affected packages

Affected packages
Package	Affected	Fixed
`dompdf/dompdf` Packagist	0.6 up to 0.6.2	0.6.2
`php-dompdf` Debian:12	before 0.6.2+dfsg-1	0.6.2+dfsg-1
`dompdf/dompdf` Packagist	0.6 up to 0.6.2, plus listed versions v0.6.0v0.6.1	0.6.2
`php-dompdf` Ubuntu:Pro:16.04:LTS	before 0.6.1+dfsg-2ubuntu1+esm1, plus listed versions 0.6.1+dfsg-20.6.1+dfsg-2build10.6.1+dfsg-2ubuntu1	0.6.1+dfsg-2ubuntu1+esm1
`php-dompdf` Ubuntu:Pro:16.04:LTS From an advisory covering 5 CVEs	before 0.6.1+dfsg-2ubuntu1+esm1, plus listed versions 0.6.1+dfsg-20.6.1+dfsg-2build10.6.1+dfsg-2ubuntu1	0.6.1+dfsg-2ubuntu1+esm1
`php-dompdf` Ubuntu:Pro:18.04:LTS From an advisory covering 5 CVEs	before 0.6.2+dfsg-3ubuntu0.18.04.1~esm1, plus listed versions 0.6.2+dfsg-3	0.6.2+dfsg-3ubuntu0.18.04.1~esm1
`php-dompdf` Ubuntu:20.04:LTS From an advisory covering 5 CVEs	before 0.6.2+dfsg-3ubuntu0.20.04.1, plus listed versions 0.6.2+dfsg-3	0.6.2+dfsg-3ubuntu0.20.04.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-5011 is a medium vulnerability (CVSS 6.5) in Dompdf Project Dompdf, published January 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in dompdf/dompdf 0.6.2.

References

Show 8 moreShow less