PhpWeasyPrint vulnerabilities
4 known CVE vulnerabilities in PhpWeasyPrint, translated and rated.
- CVE-2026-49359Medium
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, the library fetched the content of option values server-side, leading to the possibility of Server-Side Request Forgery attacks and local file disclosure.
- CVE-2026-49286High
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, the output filename guard was case-sensitive, allowing bypass of the check and leading to remote code execution.
- CVE-2026-49260High
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. In versions prior to 2.5.1, there is a vulnerability that allows shell command injection due to improper validation of binary paths.
- CVE-2026-49358Low
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. In versions prior to 2.6.0, the public array `AbstractGenerator::$temporaryFiles` allows for the deletion of temporary files without verification, which can lead to unauthorized file deletions.