icinga-php-thirdparty vendors dompdf 3.1.5 at:
  vendor/dompdf/dompdf/

This version is affected by two vulnerabilities fixed in dompdf 3.1.6:

  CVE-2026-56722: local file read via SVG images embedded as data-URIs
                  (path validation bypass)
  CVE-2026-55554: chroot validation bypass via path traversal

Please update the bundled dompdf to 3.1.6 or later.

The bundled version was confirmed by reading:
  vendor/dompdf/dompdf/version (contains: 3.1.5)

Found by: Attack of the Clones GSoC 2026 pipeline
  (salsa.debian.org/rouca/gsoc2026)

Gajendra

Upstream needs to update their composer config.

Kind Regards,

Bas

We believe that the bug you reported is fixed in the latest version of
icinga-php-thirdparty, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1145374@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bas Couwenberg <sebastic@debian.org> (supplier of updated icinga-php-thirdparty package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 15 Sep 2026 04:12:03 -0700
Source: icinga-php-thirdparty
Architecture: source
Version: 1.0.1-1
Distribution: unstable
Urgency: high
Maintainer: Debian Nagios Maintainer Group <pkg-nagios-devel@lists.alioth.debian.org>
Changed-By: Bas Couwenberg <sebastic@debian.org>
Closes: 1145374
Changes:
 icinga-php-thirdparty (1.0.1-1) unstable; urgency=high
 .
   * New upstream release.
     (closes: #1145374)
   * Remove more documentation outside usr/share/doc.
Checksums-Sha1:
 e19dcc26cdd08a684d0eae652ef00e0f33e26433 2053 icinga-php-thirdparty_1.0.1-1.dsc
 37fee826f07ee3c14ee85c05d06d7215ff67736b 11518900 icinga-php-thirdparty_1.0.1.orig.tar.gz
 022fc7890fe7a6dbc23941ee3dcdbcc81086eafa 8912 icinga-php-thirdparty_1.0.1-1.debian.tar.xz
 8adc3ef7bc7bc6fc1fe9480b0e9152f0bf2b7a19 7398 icinga-php-thirdparty_1.0.1-1_amd64.buildinfo
Checksums-Sha256:
 7989441943b25d4a3c68711e59588e96ba2bd6ca2b3ebab745604211bb0c1415 2053 icinga-php-thirdparty_1.0.1-1.dsc
 23a8a04e5d07bf2ebca7b1d7fec7811e332a8f25d2791eeedf267cd902db7121 11518900 icinga-php-thirdparty_1.0.1.orig.tar.gz
 a9a51db302093707d12b51705e4e6ccd84dc65192fc9b938cfcd356e2b9a2df4 8912 icinga-php-thirdparty_1.0.1-1.debian.tar.xz
 40da48e828913069c178880171d48105c1aff2aee378e05681d28d778b5c0373 7398 icinga-php-thirdparty_1.0.1-1_amd64.buildinfo
Files:
 1559e7157fef69921472bbf4e0e2cede 2053 admin optional icinga-php-thirdparty_1.0.1-1.dsc
 80119ea5f540fc173a3d9c7fcb8e929a 11518900 admin optional icinga-php-thirdparty_1.0.1.orig.tar.gz
 e239e85356e706a9ac49400183a8dbfb 8912 admin optional icinga-php-thirdparty_1.0.1-1.debian.tar.xz
 770a625fa08e59d5cab3e7c0dacfa229 7398 admin optional icinga-php-thirdparty_1.0.1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgYLeQXBWQI1hRlDRZ1DxCuiNSvEFAmqpKVEACgkQZ1DxCuiN
SvHxxw//QLUHKAONTvyKwCJk9TC+jGuK0k7tOhQ8oUpSqvDo81SDxil2pUYq7aK1
KBmUN2voS8M6vqIxestYYrzPPlU+ijM2eAlCWhWSMUbSo2w4LJsTfiDnf3s+Nmxp
VVNg3KT6PPMBWit7ohAP9JU5lwhVoLXH4W1bjJMKqUGRPyHeb7EH9TrFrCsstjH0
+aflt3WipUM5YyKWbD64R8WOT3iD50ih9Rx4OqnUcXdCRPbRe7041rlZPB+2Hhga
1Uqez0sDkcAIwPAXJeu514bU+6ieljDeMQZU1a3y9O+dCMWzTF6CIR3sEIYyFnKo
DgO+9YhZvG9KW/nCqJQvrlLaDxls87NfJ8GNbOdoBVJH3ZHij1Mdv+egVO4ZJ9Hm
0waodPb10scKOVrMSr3lvGzTncuJ8T8bqxmRW2t1DS00nFVQj/8gwVjUOtiyu/xx
qi2XafqARW+k7zd1lXmDbR+tMZkrua3s1oAgaceVYii3Zs72/g3AbCoMXwV9rSy3
vBIucFPXCCo7uL1OrPcHW98pqFwHmE8QXk4H2qtdHloJ7XRLf61B4rQmRBAMKGCC
7a2h+EiJ8GXdsDxsuw7ZYNAJSFQmnCp0TI87bzVFHSWih1V7YxhNiGcD47sSDB/Q
kvsYr8yCBAAaqEXylzv2gx7JwWANWQtQ0uba4O5ELi5cbWxN1OQ=
=+BAO
-----END PGP SIGNATURE-----