CVE-2014-2383

Exp

dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.

Published: 2014-04-28 Last update: 2026-05-06 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2014-2383

EPSS CVSS CWE GHSA Exploit-DB Affected OS Tracker

Conclusion & alert: CVE-2014-2383 is rated High Exploit Risk (77/100): CVSS Medium severity, with high exploitation likelihood (EPSS 54.89%, 98th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2014-2383

EDB-ID	Source	Kind	Published	Link
33004	exploit_db	edb	2014-04-24	Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2014-2383

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-03-04	54.37%	54.89%	+0.52%
2	2026-03-01	54.89%	54.37%	-0.52%
3	2026-02-04	—	54.89%	—

Full EPSS history (56 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2014-2383

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.8	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	8.6	6.4	[email protected]

Weakness enumeration for CVE-2014-2383

CWE-200 MITRE ↗

GitHub Security Advisory for CVE-2014-2383

GHSA-qr6q-w4gj-3865 · Severity: medium · Ecosystem: composer — DOMPDF Arbitrary File Read

OS Trackers for CVE-2014-2383

vendor	priority	summary	link
`debian`	unimportant	CVE-2014-2383 unimportant priority: Debian including 1 source packages (php-dompdf), 3 status rows across 3 suites (bookworm, bullseye, sid): resolved 3.	https://security-tracker.debian.org/tracker/CVE-2014-2383
`ubuntu`	medium	CVE-2014-2383 medium priority: Ubuntu including 1 source packages (php-dompdf), 16 status rows across 16 suites (artful, bionic, cosmic, disco, lucid, precise, quantal, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): not-affected 10, DNE 5, released 1.	https://ubuntu.com/security/CVE-2014-2383

Affected software / configurations for CVE-2014-2383

Vendor	Product	Version	Raw CPE
dompdf	dompdf	<= 0.6.0	cpe:2.3:a:dompdf:dompdf::beta3::::::*

References for CVE-2014-2383

URL	Tags
http://seclists.org/fulldisclosure/2014/Apr/258	Mailing List Third Party Advisory
http://www.securityfocus.com/archive/1/531912/100/0/threaded	Broken Link Third Party Advisory VDB Entry
https://explore.avertium.com/resource/lfi-rfi-escalation-to-rce
https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028	Patch Third Party Advisory
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/	Broken Link

cvelogic Threat Intelligence