p PatchFirst

CVE-2026-49358

CVE-2026-49358 · PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

CVSS 3.0 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • php-weasyprint

    Versions
    • < 2.6.0: Affected

    No fix published

  • pontedilana/php-weasyprint Packagist

    Versions
    • 0.10.0
    • 0.10.1
    • 0.11.0
    • 0.12.0
    • 0.13.0
    • 0.9.0
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.5.1
    Affected ranges
    • ECOSYSTEM: < 2.6.0

    Update to 2.6.0

Original sources

Check your server →