CVE-2026-49358
Published: June 19th, 2026
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.
LOW
CVSS v3: 3
CVSS v3: 3
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | snappy (1.1.3) | False Positive | Code Not Present | This CVE affects the PhpWeasyPrint PHP library (pontedilana/php-weasyprint), a downstream of the KnpLabs/snappy PHP library. It is an arbitrary file deletion issue (CWE-73) where the public AbstractGenerator::$temporaryFiles array is passed to unlink() by removeTemporaryFiles() (called from __destruct() and a shutdown function) without confining paths to the temporary folder. Document Filters bundles the unrelated Google Snappy C++ compression library (version 1.1.3, external/snappy-1.1.3), which contains no PHP code, no AbstractGenerator/temporaryFiles/removeTemporaryFiles() logic, and performs no filesystem cleanup via unlink(). No .php files exist in the codebase. Sibling CVEs CVE-2023-28115, CVE-2026-49260, CVE-2026-49286 and CVE-2026-49359 on the same PHP library are already tracked here as false positives for the same library-name confusion. |
| 26.2 | snappy (1.1.3) | Needs Triage | ||
| 26.1 | snappy (1.1.3) | Needs Triage | ||
| 25.4 | snappy (1.1.3) | Needs Triage | ||
| 25.3 | snappy (1.1.3) | Needs Triage | ||
| 25.2 | snappy (1.1.3) | Needs Triage | ||
| 25.1 | snappy (1.1.3) | Needs Triage | ||
| 24.4 | snappy (1.1.3) | Needs Triage | ||
| 24.4.0 | snappy (1.1.3) | Needs Triage | ||
| 24.3 | snappy (1.1.3) | Needs Triage | ||
| 24.2 | snappy (1.1.3) | Needs Triage | ||
| 24.1 | snappy (1.1.3) | Needs Triage | ||
| 23.3 | snappy (1.1.3) | Needs Triage | ||
| 23.2 | snappy (1.1.3) | Needs Triage | ||
| 23.1 | snappy (1.1.3) | Needs Triage | ||
| 22.4 | snappy (1.1.3) | Needs Triage | ||
| 22.3 | snappy (1.1.3) | Needs Triage | ||
| 22.2 | snappy (1.1.3) | Needs Triage | ||
| 22.1 | snappy (1.1.3) | Needs Triage | ||
| 21.11 | snappy (1.1.3) | Needs Triage | ||
| 21.8 | snappy (1.1.3) | Needs Triage | ||
| 21.5.0 | snappy (1.1.3) | Needs Triage | ||
| 21.2.0 | snappy (1.1.3) | Needs Triage | ||
| 11.4.19.3667 | snappy (1.1.3) | Needs Triage | ||
| 11.4.18.3599 | snappy (1.1.3) | Needs Triage | ||
| 11.4.16.3445 | snappy (1.1.3) | Needs Triage | ||
| 11.4.15.3368 | snappy (1.1.3) | Needs Triage | ||
| 11.4.14.3263 | snappy (1.1.3) | Needs Triage | ||
| 11.4.13.3179 | snappy (1.1.3) | Needs Triage | ||
| 11.4.12.3054 | snappy (1.1.3) | Needs Triage | ||
| 11.4.11.3040 | snappy (1.1.3) | Needs Triage | ||
| 11.4.11.2990 | snappy (1.1.3) | Needs Triage | ||
| 11.4.10.2934 | snappy (1.1.3) | Needs Triage | ||
| 11.4.9.2878 | snappy (1.1.3) | Needs Triage | ||
| 11.4.8.2822 | snappy (1.1.3) | Needs Triage |
Severity score breakdown
Attack Complexity
HIGH
Attack Vector
LOCAL
Availability Impact
LOW
Base Score
3
Base Severity
LOW
Confidentiality Impact
NONE
Integrity Impact
LOW
Privileges Required
HIGH
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Version
3.1