PT-2026-51002 · Pontedilana · Php-Weasyprint

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-49359

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, pontedilana/php-weasyprint fetches the content of option values server-side via file get contents() when the value looks like a URL, without restricting the URL scheme. The attachment option of Pdf is the reachable sink: any value that passes isOptionUrl() (filter var(..., FILTER VALIDATE URL)) is downloaded by the PHP process and embedded into the generated PDF. Because FILTER VALIDATE URL accepts http, https, ftp, file and PHP stream wrappers such as php://, an attacker who can influence the attachment value reaches both a Server-Side Request Forgery primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (file://, php://filter/...), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its xsl-style-sheet option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-49359

Produtos afetados

Php-Weasyprint

Referências · 5

• https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56 · Nota
• https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36 · Nota
• https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-49359 · Nota de Segurança
• https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb · Nota