PT-2026-42615 · Packagist · Knplabs/Knp-Snappy

Published

2026-05-21

·

Updated

2026-05-21

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N

Impact

It impacts applications where:
  • the PHP daemon run with root permissions ;
  • the application is either running outside a container or has sensitive file access ;
It could happens with this kind of workflows:
php
$stylesheet = $ GET['stylesheet']; // = ‘file:///etc/passwd’
$pdf = new KnpSnappyPdf(‘/usr/local/bin/wkhtmltopdf’);
 $pdf->generate(‘page.html’, ‘out.pdf’, [
  ‘xsl-style-sheet’ => $stylesheet
 ]);

Patches

A list a schema with http and https by default is used to validate the remote path by default.

Workarounds

Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library.
php
// Bad example
$pdf = new KnpSnappyPdf(‘/usr/local/bin/wkhtmltopdf’);
 $pdf->generate(‘page.html’, ‘out.pdf’, [
  ‘xsl-style-sheet’ => $ GET['input'],
 ]);
Instead developers can list available available stylesheets and pick the right one with the user input.
php
// Better
$allowedStylesheets = [
  'invoice' => '/app/xsl/invoice.xsl',
  'report' => '/app/xsl/report.xsl',
];

$key = $ GET['stylesheet'] ?? '';

if (!array key exists($key, $allowedStylesheets)) {
  throw new RuntimeException('Unknown stylesheet.');
}

$pdf = new KnpSnappyPdf('/usr/local/bin/wkhtmltopdf');
$pdf->generate('page.html', 'out.pdf', [
  'xsl-style-sheet' => $allowedStylesheets[$key],
]);

References

Read more about SSRF at [owasp.org/www-community/attacks/Server Side Request Forgery](https://owasp.org/www-community/attacks/Server Side Request Forgery)

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

GHSA-C5FP-P67M-GQ56

Affected Products

Knplabs/Knp-Snappy