---
title: "CVE-2023-24813\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2023-24813?format=md
keywords: index, follow
---

# CVE-2023-24813

Publication date 7 February 2023

Last updated 26 August 2025

---

Ubuntu priority

**High**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**9.8 · Critical**

[Score breakdown](https://ubuntu.com/security/CVE-2023-24813?format=md#impact-score)

Toggle side navigation

## Description

Dompdf is an HTML to PDF converter written in php. Due to the difference in
the attribute parser of Dompdf and php-svg-lib, an attacker can still call
arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute
of `image` tags and respects `xlink:href` even if `href` is specified.
However, php-svg-lib, which is later used to parse the svg file, parses the
href attribute. Since `href` is respected if both `xlink:href` and `href`
is specified, it's possible to bypass the protection on the Dompdf side by
providing an empty `xlink:href` attribute. An attacker can exploit the
vulnerability to call arbitrary URLs with arbitrary protocols if they
provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads
to arbitrary unserialize, which will lead, at the very least, to arbitrary
file deletion and might lead to remote code execution, depending on
available classes. This vulnerability has been addressed in commit
`95009ea98` which has been included in release version 2.0.3. Users are
advised to upgrade. There are no known workarounds for this vulnerability.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2023-24813?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| php-dompdf | 23.04 lunar | Not in release |
| 22.10 kinetic | Not affected |
| 22.04 LTS jammy | Not affected |
| 20.04 LTS focal | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Not affected |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2023-24813?format=md#patch-details)

## Notes

---

### [sbeattie](https://launchpad.net/~sbeattie)

in Ubuntu versions src/Image/Cache.php is in
./include/image\_cache.cls.php and does not contain the affected code.

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| php-dompdf | * Upstream:   [95009ea](https://github.com/dompdf/dompdf/commit/95009ea98230f9b084b040c34e3869ef3dccc9aa) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

9.8 · Critical

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 9.8 · Critical |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24813)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-24813)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2023-24813)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2023-24813)

### Other references

* <https://github.com/dompdf/dompdf/security/advisories/GHSA-56gj-mvh6-rp75>
* <https://github.com/dompdf/dompdf/commit/95009ea98230f9b084b040c34e3869ef3dccc9aa>
* <https://www.cve.org/CVERecord?id=CVE-2023-24813>