CVE-2021-3902

CVE-2021-3902 is a critical Improper Restriction of External Entities (XXE) vulnerability in dompdf/dompdf's SVG parser, affecting all versions prior to 2.0.0. This flaw allows attackers to perform Server-Side Request Forgery (SSRF), disclose internal files, and execute PHAR deserialization attacks, even when remote access is disabled. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector and low complexity, enabling complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness among security researchers.