---
title: "GHSA-97m3-52wr-xvv2: Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE"
url: https://erroneo.us/security/ghsa/GHSA-97m3-52wr-xvv2/
description: "GHSA-97m3-52wr-xvv2 (critical, Composer (PHP)): Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE.…"
type: advisory
section: "Security Digest"
date_published: 2024-02-22
date_modified: 2026-03-24
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-97m3-52wr-xvv2"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-97m3-52wr-xvv2: Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

## Affected packages

- Composer (PHP) `phenx/php-svg-lib` < 0.5.2 → fixed: 0.5.2

## Details

Summary A lack of sanitization/check in the font path returned by php-svg-lib, in the case of a inline CSS font defined, that will be used by Cpdf to open a font will be passed to a fileexists call, which is sufficient to trigger metadata unserializing on a PHAR file, through the phar:// URL handler on PHP

## Sources

- [GitHub Advisory GHSA-97m3-52wr-xvv2](https://github.com/advisories/GHSA-97m3-52wr-xvv2)
- [github.com](https://github.com/dompdf/dompdf/security/advisories/GHSA-97m3-52wr-xvv2)
- [github.com](https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273)
- [github.com](https://github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa)

---
Source page: https://erroneo.us/security/ghsa/GHSA-97m3-52wr-xvv2/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt