CVE-2014-2383

CVE-2014-2383 is a critical arbitrary file read vulnerability affecting dompdf versions prior to 0.6.1, specifically when the DOMPDF_ENABLE_PHP option is enabled. An attacker can exploit this by manipulating the input_file parameter with PHP protocol wrappers, such as php://filter, to bypass chroot protections and access sensitive files on the server. This vulnerability carries a CVSS score of 6.8, indicating a medium to high severity with a network attack vector, medium complexity, and potential for partial confidentiality, integrity, and availability impact. While not listed on the KEV catalog, exploit code is publicly available on ExploitDB and Nuclei templates exist, suggesting a moderate risk of exploitation; however, there is no evidence of active exploitation or significant community discussion.