CVE-2026-49286 Details
Description
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue.
A remote code execution vulnerability has been identified in the PhpWeasyPrint library, specifically in versions prior to 2.6.0. The issue arises from improper validation of the output filename in the 'generateFromHtml()' function, allowing a case-insensitive bypass of the 'phar://' stream wrapper check. This vulnerability enables the deserialization of a crafted PHAR archive's metadata on PHP 7, leading to arbitrary code execution. The same issue was previously disclosed as CVE-2023-28115 and has been patched in version 2.6.0.
Users are advised to update to PhpWeasyPrint version 2.6.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-2fmj-p74r-3wjm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/pontedilana/php-weasyprint/commit/d1aa487722b5a3cab9b222b85fdb5608a5a550c3 | [email protected] | Source CodeVendor |
| https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0 | [email protected] | Release NotesVendor |
| https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-2fmj-p74r-3wjm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pontedilana PhpWeasyPrint | <= 2.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |