CVE-2022-28368: Dompdf remote code execution via CSS @font-face src:url

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction RCE and a 99.6th percentile EPSS score make this an urgent patch target.

What it is

Dompdf 1.2.1 permits remote code execution when an HTML input containing an @font-face CSS rule with a .php file in the src:url field is processed. Because Dompdf is a PHP library commonly used to render untrusted HTML into PDFs, any application passing user-supplied markup to it is exposed. The flaw is rated critical (CVSS 3.1 9.8) and has a very high EPSS score, indicating substantial real-world exploitation likelihood.

Impact

An attacker can execute arbitrary PHP code in the context of the application server, leading to full compromise of confidentiality, integrity and availability. This can result in data theft, webshell placement or lateral movement from the hosting service.

Attack surface

Reachable over the network with no authentication and no user interaction (CVSS vector AV:N/AC:L/PR:N/UI:N). The attacker only needs to get crafted HTML containing the malicious @font-face rule into a Dompdf rendering path.

Exploitation

Not listed in CISA KEV, but EPSS is 0.82438 (99.6th percentile) and references include an Exploit-tagged Snyk advisory and a Packet Storm RCE write-up, so public exploitation techniques exist. No ransomware group usage is documented in the record.

What to do

• Upgrade Dompdf to a version containing the fix from commit 4c70e1025bcd9b7694b95dd552499bd83cd6141d (patch references are provided; the record does not state the exact fixed version).
• If immediate upgrade is not possible, disable or restrict remote font loading and block .php URLs in CSS src:url handling.
• Sanitize or reject untrusted HTML/CSS before passing it to Dompdf, and avoid rendering user-controlled markup with the library.
• Run the PHP process rendering PDFs with least privilege and restrict outbound network access to reduce post-exploitation impact.

Detection

• Search application and web logs for requests or inputs containing @font-face with src:url pointing to .php files.
• Monitor for unexpected PHP file creation or execution in web-accessible directories on hosts running Dompdf.
• Alert on outbound HTTP requests from PDF-rendering services to unusual hosts, which may indicate font or payload retrieval.
• Inventory applications and dependencies for Dompdf 1.2.1 and confirm patched versions are deployed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.