PT-2023-12337 · Php+6 · Php+6

Published 2022-06-18 · Updated 2025-12-30 · CVE-2021-3838

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DomPDF versions prior to 2.0.0

Description The issue is related to PHAR deserialization due to a lack of checking on the protocol before passing it into the file get contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to prevent exploitation. Additionally, restrict access to the file get contents() function to minimize the risk of remote code execution.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2022-2070

ALT-PU-2022-2091

ALT-PU-2025-6362

CVE-2021-3838

DLA-3495-1

DLA-3495-2

DLA-4427-1

GHSA-577P-7J7H-2JGF

USN-6277-1

USN-6277-2

Affected Products

Alt Linux

Debian

Dompdf

Laravel

Linuxmint

Php

Ubuntu

References · 27

• 🔥 https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e · Exploit
• https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a · Patch
• https://osv.dev/vulnerability/USN-6277-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6277-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3838 · Security Note
• https://ubuntu.com/security/notices/USN-6277-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3838 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-577p-7j7h-2jgf · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4427-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5013 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6277-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3838 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3838 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2400 · Vendor Advisory