CVE-2014-5013
DOMPDF Remote Code Execution
CVE-2014-5013 is a high vulnerability (CVSS 8.8) in Dompdf Project Dompdf, published January 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.48%, the 91st percentile. Fixed in dompdf/dompdf 0.6.2.
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Record
CVE-2014-5013- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Record
CVE-2014-5013- Updated
- 2026-11-02
EUVDEUVD-2022-4394 No score
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Record
EUVD-2022-4394- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jjwj-w3gc-gcw4
DOMPDF Remote Code Execution
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Record
GHSA-jjwj-w3gc-gcw4- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Record
CVE-2014-5013- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-5013
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Record
DEBIAN-CVE-2014-5013- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-jjwj-w3gc-gcw4
DOMPDF Remote Code Execution
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Record
GHSA-jjwj-w3gc-gcw4- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-5013
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
- Record
UBUNTU-CVE-2014-5013- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-6277-1 No score
php-dompdf vulnerabilities
It was discovered that Dompdf was not properly validating untrusted input when processing HTML content under certain circumstances. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2014-5011, CVE-2014-5012, CVE-2014-5013)
It was discovered that Dompdf was not properly validating processed HTML content that referenced PHAR files, which could result in the deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-3838)
It was discovered that Dompdf was not properly validating processed HTML content that referenced both a remote base and a local file, which could result in the bypass of a chroot check. An attacker could possibly use this issue to expose sensitive information. (CVE-2022-2400)
- Record
USN-6277-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dompdf/dompdfPackagist |
0.6 up to 0.6.2 | 0.6.2 |
php-dompdfDebian:12 |
before 0.6.2+dfsg-1 | 0.6.2+dfsg-1 |
dompdf/dompdfPackagist |
0.6 up to 0.6.2, plus listed versions v0.6.0v0.6.1 |
0.6.2 |
php-dompdfUbuntu:Pro:16.04:LTS |
before 0.6.1+dfsg-2ubuntu1+esm1, plus listed versions 0.6.1+dfsg-20.6.1+dfsg-2build10.6.1+dfsg-2ubuntu1 |
0.6.1+dfsg-2ubuntu1+esm1 |
php-dompdfUbuntu:Pro:18.04:LTS |
before 0.6.2+dfsg-3ubuntu0.18.04.1~esm1, plus listed versions 0.6.2+dfsg-3 |
0.6.2+dfsg-3ubuntu0.18.04.1~esm1 |
php-dompdfUbuntu:20.04:LTS |
before 0.6.2+dfsg-3ubuntu0.20.04.1, plus listed versions 0.6.2+dfsg-3 |
0.6.2+dfsg-3ubuntu0.20.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/dompdf/dompdf/releases/tag/v0.6.2
nvd.nist.gov/vuln/detail/CVE-2014-5013
security-tracker.debian.org/tracker/CVE-2014-5013