CVE-2026-49359
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, the library fetched the content of option values server-side, leading to the possibility of Server-Side Request Forgery attacks and local file disclosure.
Risk Assessment
Organizations may be exposed to attacks that allow access to internal HTTP endpoints and local file disclosure, potentially leading to sensitive data leaks.
Recommendation
It is recommended to update the PhpWeasyPrint library to version 2.6.0 or later to patch this vulnerability.
Other vulnerabilities in PhpWeasyPrint
See all- CVE-2026-49286High
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, the output filename guard was case-sensitive, allowing bypass of the check and leading to remote code execution.
- CVE-2026-49260High
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. In versions prior to 2.5.1, there is a vulnerability that allows shell command injection due to improper validation of binary paths.
- CVE-2026-49358Low
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. In versions prior to 2.6.0, the public array `AbstractGenerator::$temporaryFiles` allows for the deletion of temporary files without verification, which can lead to unauthorized file deletions.
Original NVD description (English source)
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue.