CVE-2026-49359
PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
Description
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue.
INFO
Published Date :
June 19, 2026, 6:16 p.m.
Last Modified :
Oct. 25, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | MITRE-CVE | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the PhpWeasyPrint library to version 2.6.0.
- Ensure user input is not directly used in attachment options.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-49359.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-49359 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-49359
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-49359 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-49359 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: php-weasyprint de pontedilana, Description: PhpWeasyPrint es una biblioteca PHP que permite la generación de PDF desde una URL o una página HTML. Antes de la versión 2.6.0, ’pontedilana/php-weasyprint’ obtiene el contenido de los valores de las opciones del lado del servidor a través de ’file_get_contents()’ cuando el valor parece una URL, sin restringir el esquema de la URL. La opción ’attachment’ de ’Pdf’ es el sumidero alcanzable: cualquier valor que pase ’isOptionUrl()’ (’filter_var(..., FILTER_VALIDATE_URL)’) es descargado por el proceso PHP e incrustado en el PDF generado. Debido a que ’FILTER_VALIDATE_URL’ acepta ’http’, ’https’, ’ftp’, ’file’ y envoltorios de flujo PHP como ’php://’, un atacante que puede influir en el valor de ’attachment’ alcanza tanto una primitiva de falsificación de petición del lado del servidor (p. ej., puntos finales HTTP internos, metadatos de la nube) como una primitiva de divulgación de archivos locales (’file: //’, ’php://filter/...’), con los bytes obtenidos exfiltrados como un adjunto PDF. Esta es la misma clase de problema que KnpLabs/snappy parcheó para su opción ’xsl-style-sheet’ en GHSA-c5fp-p67m-gq56. La biblioteca está documentada como un sustituto uno a uno de KnpLabs/snappy y comparte la misma forma de código. PhpWeasyPrint versión 2.6.0 contiene un parche para el problema. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 23, 2026
Action Type Old Value New Value Added Reference https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36 Added SSVC {'id': 'CVE-2026-49359', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-23T02:15:43.408580Z'} -
New CVE Received by [email protected]
Jun. 19, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'pontedilana', 'product': 'php-weasyprint', 'versions': [{'status': 'affected', 'version': '< 2.6.0'}]}] Added Description PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-918 Added Reference https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56 Added Reference https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb Added Reference https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0 Added Reference https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36