Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-m27n-v4kb-9qe6
Vulnerability ID VCID-m27n-v4kb-9qe6
Aliases CVE-2022-0085
GHSA-pf6p-25r2-fx45
Summary Server-Side Request Forgery in dompdf/dompdf
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00437 https://api.first.org/data/v1/epss?cve=CVE-2022-0085
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-pf6p-25r2-fx45
cvssv3.1 5.3 https://github.com/dompdf/dompdf
generic_textual MODERATE https://github.com/dompdf/dompdf
cvssv3.1 5.3 https://github.com/dompdf/dompdf/commit/bb1ef65011a14730b7cfbe73506b4bb8a03704bd
generic_textual MODERATE https://github.com/dompdf/dompdf/commit/bb1ef65011a14730b7cfbe73506b4bb8a03704bd
cvssv3.1 5.3 https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-0085.yaml
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-0085.yaml
cvssv3.1 5.3 https://huntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236
generic_textual MODERATE https://huntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2022-0085
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-0085
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-0085
https://github.com/dompdf/dompdf
https://github.com/dompdf/dompdf/commit/bb1ef65011a14730b7cfbe73506b4bb8a03704bd
https://huntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236
CVE-2022-0085 https://nvd.nist.gov/vuln/detail/CVE-2022-0085
CVE-2022-0085.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-0085.yaml
GHSA-pf6p-25r2-fx45 https://github.com/advisories/GHSA-pf6p-25r2-fx45
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/dompdf/dompdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/dompdf/dompdf/commit/bb1ef65011a14730b7cfbe73506b4bb8a03704bd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-0085.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://huntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-0085
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.63504
EPSS Score 0.00437
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:31:44.213229+00:00 GHSA Importer Import https://github.com/advisories/GHSA-pf6p-25r2-fx45 38.6.0