Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-tshn-sa2g-cbac
Vulnerability ID VCID-tshn-sa2g-cbac
Aliases CVE-2021-3902
GHSA-3vjh-xrhf-v9xh
Summary An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-611 Improper Restriction of XML External Entity Reference
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0509 https://api.first.org/data/v1/epss?cve=CVE-2021-3902
epss 0.0509 https://api.first.org/data/v1/epss?cve=CVE-2021-3902
epss 0.0509 https://api.first.org/data/v1/epss?cve=CVE-2021-3902
epss 0.0509 https://api.first.org/data/v1/epss?cve=CVE-2021-3902
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-3vjh-xrhf-v9xh
cvssv3.1 9.8 https://github.com/dompdf/dompdf
generic_textual CRITICAL https://github.com/dompdf/dompdf
cvssv3 9.8 https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
cvssv3.1 9.8 https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
generic_textual CRITICAL https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
ssvc Track* https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
cvssv3 9.8 https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
cvssv3.1 9.8 https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
generic_textual CRITICAL https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
ssvc Track* https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2021-3902
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2021-3902
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-3902
https://github.com/dompdf/dompdf
https://nvd.nist.gov/vuln/detail/CVE-2021-3902
a6071c07-806f-429a-8656-a4742e4191b1 https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
f56bc8e40be6c0ae0825e6c7396f4db80620b799 https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
GHSA-3vjh-xrhf-v9xh https://github.com/advisories/GHSA-3vjh-xrhf-v9xh
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/dompdf/dompdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-11-18T14:34:31Z/ Found at https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-11-18T14:34:31Z/ Found at https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3902
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.90023
EPSS Score 0.0509
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:33:24.336474+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2021/3xxx/CVE-2021-3902.json 38.6.0