CVE-2023-24813

CVE-2023-24813 is a critical vulnerability affecting Dompdf, an HTML to PDF converter, stemming from a parsing discrepancy between Dompdf and php-svg-lib. An attacker can craft a malicious SVG file to bypass Dompdf's URL validation, enabling arbitrary URL calls with arbitrary protocols. This can lead to arbitrary unserialization in PHP versions before 8.0.0, potentially resulting in arbitrary file deletion or remote code execution. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low complexity and no user interaction, impacting confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, users are strongly advised to upgrade to Dompdf version 2.0.3 or later to mitigate this risk.