Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3y27-a2g7-vbff
Vulnerability ID VCID-3y27-a2g7-vbff
Aliases CVE-2021-3838
GHSA-577p-7j7h-2jgf
Summary DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-502 Deserialization of Untrusted Data
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.06926 https://api.first.org/data/v1/epss?cve=CVE-2021-3838
epss 0.06926 https://api.first.org/data/v1/epss?cve=CVE-2021-3838
epss 0.06926 https://api.first.org/data/v1/epss?cve=CVE-2021-3838
epss 0.06926 https://api.first.org/data/v1/epss?cve=CVE-2021-3838
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-577p-7j7h-2jgf
cvssv3.1 9.8 https://github.com/dompdf/dompdf
generic_textual CRITICAL https://github.com/dompdf/dompdf
cvssv3 9.8 https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
cvssv3.1 9.8 https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
generic_textual CRITICAL https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
ssvc Track* https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
cvssv3 9.8 https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
cvssv3.1 9.8 https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
generic_textual CRITICAL https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
ssvc Track* https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2021-3838
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2021-3838
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-3838
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3838
https://github.com/dompdf/dompdf
https://nvd.nist.gov/vuln/detail/CVE-2021-3838
0bdddc12-ff67-4815-ab9f-6011a974f48e https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
99aeec1efec9213e87098d42eb09439e7ee0bb6a https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
GHSA-577p-7j7h-2jgf https://github.com/advisories/GHSA-577p-7j7h-2jgf
USN-6277-1 https://usn.ubuntu.com/6277-1/
USN-6277-2 https://usn.ubuntu.com/6277-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/dompdf/dompdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-11-18T14:40:28Z/ Found at https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-11-18T14:40:28Z/ Found at https://huntr.com/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3838
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.91608
EPSS Score 0.06926
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:33:24.407062+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2021/3xxx/CVE-2021-3838.json 38.6.0