dompdf - Path Traversal (CVE-2014-2383)
Description
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
psychologyCrowdSec Analysis
CVE-2014-2383 is a vulnerability affecting the dompdf library, which can allow attackers to bypass security restrictions and access arbitrary files through specially crafted parameters.
CrowdSec has been tracking this vulnerability and its exploits since 7th of May 2025.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2014-2383 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2014-2383 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Observed attack patterns are aimed at URLs referencing various dompdf.php paths across plugin or library directories.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2014-04-28 |
| Rule Released | 2025-05-07 |
| CrowdSec First Seen | 2025-05-07 |