CVE-2026-49359 Details
Description
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue.
A vulnerability in the PhpWeasyPrint library, prior to version 2.6.0, allows for server-side request forgery (SSRF) and local file disclosure. The issue arises because the library fetches content from URLs specified in the 'attachment' option using 'file_get_contents()', without restricting the URL scheme. This behavior can be exploited by an attacker who can influence the 'attachment' value, leading to the exfiltration of internal HTTP responses or local file content through the generated PDF. The vulnerability is similar to an issue previously identified in KnpLabs/snappy, which PhpWeasyPrint is designed to replace.
Users can update to PhpWeasyPrint version 2.6.0 or later, which addresses the vulnerability by restricting the allowed URL schemes to 'http' and 'https' by default. Instructions for updating can be found in the library's release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56 | [email protected] | AdvisoryNot Applicable |
| https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb | [email protected] | Source CodeVendor |
| https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0 | [email protected] | Release NotesVendor |
| https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pontedilana PhpWeasyPrint | <= 2.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |