CVE-2022-41343

7.5 highEPSS 6.0%

High (7.5) in dompdf project dompdf. EPSS 6.0% chance of exploitation in the next 30 days.

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 6.0% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-552
Published: 2022-09-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dompdf_project:dompdf

References

https://github.com/dompdf/dompdf/issues/2994
https://github.com/dompdf/dompdf/pull/2995
https://github.com/dompdf/dompdf/releases/tag/v2.0.1
https://tantosec.com/blog/cve-2022-41343/
https://github.com/dompdf/dompdf/issues/2994

Check your stack JSON