Improper input validation in Dompdf

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with  realpath() . Because normalization strips the trail…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)