PT-2026-42646 · Packagist · Knplabs/Knp-Snappy

Published

2026-05-21

·

Updated

2026-05-21

CVSS v4.0

7.5

High

VectorAV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Impact

On POSIX, escapeshellarg(‘/usr/bin/wkhtmltopdf’) returns the literal string ‘/usr/bin/wkhtmltopdf’ with the single-quote characters included. is executable() then looks for a file whose actual name contains those quote characters, which essentially never exists. The safe branch is dead code and $command always falls through to the raw, unescaped value.
The rest of the arguments (options, input, output) are escaped correctly, so injection has to land in the binary string itself. That happens whenever the binary path is sourced from configuration that is user-influenced, derived from environment variables that ultimately come from request data, or concatenated with any user-controlled fragment.

Proof of concept:

 $pdf = new KnpSnappyPdf(‘wkhtmltopdf; touch /tmp/snappy rce’);
 $pdf->generate(‘https://example.com’, ‘/tmp/out.pdf’);
 // /tmp/snappy rce is created.
Impact: command execution as the PHP process when the binary path is attacker-influenced. Even in deployments where the binary is hard-coded, this is a defensive-in-depth regression: downstream packages reasonably assume Snappy shell-escapes the binary because the code looks like it does.

Patches

The version 1.7.1 will resolve this security advisory.

Workarounds

Before calling the constructor, ensure is executable($path) is truthy.
// Bad example
$pdf = new KnpSnappyPdf('/path/to/binary');
// Better example
$pathToBinary = '/path/to/binary';

if (!is executable($pathToBinary)) {
 throw new RuntimeException();
}

$pdf = new KnpSnappyPdf('/path/to/binary');

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

GHSA-VPR4-P6FQ-85JC

Affected Products

Knplabs/Knp-Snappy