CVE-2022-2400
External Control of File Name or Path in dompdf/dompdf
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
External Control of File Name or Path in dompdf/dompdf
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- Record
CVE-2022-2400- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
EUVDEUVD-2022-6252
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- Record
EUVD-2022-6252- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qj8-6xxj-hp9h
Dompdf before v2.0.0 vulnerable to chroot check bypass
Dompdf prior to version 2.0.0 is vulnerable to a chroot check bypass, which could cause disclosure of png and jpeg files.
- Record
GHSA-5qj8-6xxj-hp9h- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
NVD
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- Record
CVE-2022-2400- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
OSV
External Control of File Name or Path in dompdf/dompdf
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- Record
CVE-2022-2400- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-2400
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- Record
DEBIAN-CVE-2022-2400- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
Show 6 moreShow less
OSVGHSA-5qj8-6xxj-hp9h
Dompdf before v2.0.0 vulnerable to chroot check bypass
Dompdf prior to version 2.0.0 is vulnerable to a chroot check bypass, which could cause disclosure of png and jpeg files.
- Record
GHSA-5qj8-6xxj-hp9h- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-2400
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
- Record
UBUNTU-CVE-2022-2400- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2025-1766019429 No score
TuxCare security update for dompdf/dompdf (7 CVEs)
TuxCare rebuilt dompdf/dompdf to address 7 CVEs. Fixed in 1.2.2-p1+tuxcare.
- Record
CLSA-2025-1766019429- Updated
- 2026-11-02
OSVCLSA-2025-1766364765 No score
TuxCare security update for dompdf/dompdf (8 CVEs)
TuxCare rebuilt dompdf/dompdf to address 8 CVEs. Fixed in 0.8.6-p1+tuxcare.
- Record
CLSA-2025-1766364765- Updated
- 2026-11-02
OSVUSN-6277-1 No score
php-dompdf vulnerabilities
It was discovered that Dompdf was not properly validating untrusted input when processing HTML content under certain circumstances. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2014-5011, CVE-2014-5012, CVE-2014-5013)
It was discovered that Dompdf was not properly validating processed HTML content that referenced PHAR files, which could result in the deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-3838)
It was discovered that Dompdf was not properly validating processed HTML content that referenced both a remote base and a local file, which could result in the bypass of a chroot check. An attacker could possibly use this issue to expose sensitive information. (CVE-2022-2400)
- Record
USN-6277-1- Updated
- 2026-11-02
OSVUSN-6277-2 No score
php-dompdf vulnerabilities
USN-6277-1 fixed vulnerabilities in Dompdf. This update provides the corresponding updates for Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that Dompdf was not properly validating untrusted input when processing HTML content under certain circumstances. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2014-5011, CVE-2014-5012, CVE-2014-5013)
It was discovered that Dompdf was not properly validating processed HTML content that referenced PHAR files, which could result in the deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-3838)
It was discovered that Dompdf was not properly validating processed HTML content that referenced both a remote base and a local file, which could result in the bypass of a chroot check. An attacker could possibly use this issue to expose sensitive information. (CVE-2022-2400)
- Record
USN-6277-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dompdf/dompdfPackagist |
before 2.0.0 | 2.0.0 |
dompdf/dompdfTuxCare:Packagist From an advisory covering 7 CVEs |
v1.2.2 up to 1.2.2-p1+tuxcare | 1.2.2-p1+tuxcare |
dompdf/dompdfTuxCare:Packagist From an advisory covering 8 CVEs |
0.8.6 up to 0.8.6-p1+tuxcare | 0.8.6-p1+tuxcare |
php-dompdfDebian:12 |
before 2.0.2+dfsg-1 | 2.0.2+dfsg-1 |
php-dompdfDebian:10 From an advisory covering 2 CVEs |
before 0.6.2+dfsg-3+deb10u1, plus listed versions 0.6.2+dfsg-3 |
0.6.2+dfsg-3+deb10u1 |
php-dompdfDebian:11 From an advisory covering 2 CVEs |
before 0.6.2+dfsg-3.1+deb11u1, plus listed versions 0.6.2+dfsg-3.1 |
0.6.2+dfsg-3.1+deb11u1 |
dompdf/dompdfPackagist |
before 2.0.0, plus listed versions v0.6.0v0.6.1v0.6.2v0.7.0v0.7.0-beta Show 17 moreShow lessv0.7.0-beta2v0.7.0-beta3v0.8.0v0.8.1v0.8.2v0.8.3v0.8.4v0.8.5v0.8.6v1.0.0v1.0.1v1.0.2v1.1.0v1.1.1v1.2.0v1.2.1v1.2.2 |
2.0.0 |
php-dompdfUbuntu:Pro:16.04:LTS |
before 0.6.1+dfsg-2ubuntu1+esm1, plus listed versions 0.6.1+dfsg-20.6.1+dfsg-2build10.6.1+dfsg-2ubuntu1 |
0.6.1+dfsg-2ubuntu1+esm1 |
civicrmUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.7.1+dfsg-14.7.1+dfsg-24.7.1+dfsg-2ubuntu14.7.1+dfsg-2ubuntu1+esm1 |
None known |
icingaweb2Ubuntu:16.04:LTS |
All versions, plus listed versions 2.1.0-1ubuntu12.1.0-1ubuntu1.12.1.0-1ubuntu1.2 |
None known |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
civicrmUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.7.23+dfsg-1ubuntu14.7.24+dfsg-1ubuntu14.7.30+dfsg-1ubuntu14.7.30+dfsg-1ubuntu1+esm1 |
None known |
icingaweb2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.4.1-12.4.1-1ubuntu0.1 |
None known |
php-dompdfUbuntu:Pro:18.04:LTS |
before 0.6.2+dfsg-3ubuntu0.18.04.1~esm1, plus listed versions 0.6.2+dfsg-3 |
0.6.2+dfsg-3ubuntu0.18.04.1~esm1 |
php-dompdfUbuntu:20.04:LTS |
before 0.6.2+dfsg-3ubuntu0.20.04.1, plus listed versions 0.6.2+dfsg-3 |
0.6.2+dfsg-3ubuntu0.20.04.1 |
civicrmUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.11.0+dfsg-15.18.1+dfsg-15.20.3+dfsg-15.21.0+dfsg-15.21.1+dfsg-15.21.2+dfsg-15.21.2+dfsg-1ubuntu0.1~esm1 |
None known |
icingaweb2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.7.1-12.7.3-1 |
None known |
icingaweb2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.8.2-22.9.3-12.9.4-12.9.5-1 |
None known |
php-dompdfUbuntu:22.04:LTS |
before 0.6.2+dfsg-3.1ubuntu0.1, plus listed versions 0.6.2+dfsg-3.1 |
0.6.2+dfsg-3.1ubuntu0.1 |
civicrmUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.33.2+dfsg1-15.33.2+dfsg1-1build15.33.2+dfsg1-1ubuntu15.33.2+dfsg1-1ubuntu1+esm1 |
None known |
icingaweb2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.11.4-32.12.0-12.12.1-1 |
None known |
icingaweb2Ubuntu:25.10 |
All versions, plus listed versions 2.12.2-12.12.4-12.12.4-2 |
None known |
icingaweb2Ubuntu:26.10 |
All versions, plus listed versions 2.12.6-12.13.0-12.14.0-1 |
None known |
icingaweb2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.12.4-22.12.5-12.12.6-1 |
None known |
php-dompdfUbuntu:Pro:16.04:LTS From an advisory covering 5 CVEs |
before 0.6.1+dfsg-2ubuntu1+esm1, plus listed versions 0.6.1+dfsg-20.6.1+dfsg-2build10.6.1+dfsg-2ubuntu1 |
0.6.1+dfsg-2ubuntu1+esm1 |
php-dompdfUbuntu:Pro:18.04:LTS From an advisory covering 5 CVEs |
before 0.6.2+dfsg-3ubuntu0.18.04.1~esm1, plus listed versions 0.6.2+dfsg-3 |
0.6.2+dfsg-3ubuntu0.18.04.1~esm1 |
php-dompdfUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 0.6.2+dfsg-3ubuntu0.20.04.1, plus listed versions 0.6.2+dfsg-3 |
0.6.2+dfsg-3ubuntu0.20.04.1 |
php-dompdfUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 0.6.2+dfsg-3.1ubuntu0.1, plus listed versions 0.6.2+dfsg-3.1 |
0.6.2+dfsg-3.1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2400 is a medium vulnerability (CVSS 5.3) in Dompdf Dompdf/dompdf, published July 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in dompdf/dompdf 2.0.0.
References
huntr.dev/bounties/a6da5e5e-86be-499a-a3c3-2950f749202a
github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
lists.debian.org/debian-lts-announce/2023/07/msg00017.html
nvd.nist.gov/vuln/detail/CVE-2022-2400
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2022-2400
ubuntu.com/security/CVE-2022-2400
cve.org/CVERecord?id=CVE-2022-2400