Remote code injection in dompdf/dompdf
Date: 2022-04
Affected: composer/dompdf/dompdf
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-28368
CWE: CWE-79
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).


Mitigations:

Architectural layers (MAESTRO):