PT-2026-51002 · Pontedilana · Php-Weasyprint

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-49359

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, pontedilana/php-weasyprint fetches the content of option values server-side via file get contents() when the value looks like a URL, without restricting the URL scheme. The attachment option of Pdf is the reachable sink: any value that passes isOptionUrl() (filter var(..., FILTER VALIDATE URL)) is downloaded by the PHP process and embedded into the generated PDF. Because FILTER VALIDATE URL accepts http, https, ftp, file and PHP stream wrappers such as php://, an attacker who can influence the attachment value reaches both a Server-Side Request Forgery primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (file://, php://filter/...), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its xsl-style-sheet option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-49359

Affected Products

Php-Weasyprint

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-49359 · Security Note
• https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56 · Note
• https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb · Note
• https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36 · Note
• https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0 · Note