Vulnerability-Lookup

CVE-2026-49358 (GCVE-0-2026-49358)

Vulnerability from cvelistv5 – Published: 2026-06-19 14:52 – Updated: 2026-06-23 02:09

Title

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

Summary

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

Severity

3 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-73 - External Control of File Name or Path

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/pontedilana/php-weasyprint/sec…	x_refsource_CONFIRM
https://github.com/KnpLabs/snappy/security/adviso…	x_refsource_MISC
https://github.com/pontedilana/php-weasyprint/com…	x_refsource_MISC
https://github.com/pontedilana/php-weasyprint/rel…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pontedilana	php-weasyprint	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49358",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T02:08:49.575183Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T02:09:16.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "php-weasyprint",
          "vendor": "pontedilana",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` \u2014 invoked from `__destruct()` and from a registered shutdown function \u2014 calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T14:52:05.368Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"
        },
        {
          "name": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4"
        },
        {
          "name": "https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391"
        },
        {
          "name": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5g9f-cwwg-4p8g",
        "discovery": "UNKNOWN"
      },
      "title": "PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49358",
    "datePublished": "2026-06-19T14:52:05.368Z",
    "dateReserved": "2026-05-29T14:35:45.904Z",
    "dateUpdated": "2026-06-23T02:09:16.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49358",
      "date": "2026-07-01",
      "epss": "0.00112",
      "percentile": "0.01624"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-49358\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-19T15:16:35.143\",\"lastModified\":\"2026-06-23T03:16:41.250\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` \u2014 invoked from `__destruct()` and from a registered shutdown function \u2014 calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"pontedilana\",\"product\":\"php-weasyprint\",\"versions\":[{\"version\":\"\u003c 2.6.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":3.0,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":0.5,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-23T02:08:49.575183Z\",\"id\":\"CVE-2026-49358\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-73\"}]}],\"references\":[{\"url\":\"https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-49358\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-23T02:08:49.575183Z\"}}}], \"references\": [{\"url\": \"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-23T02:09:11.128Z\"}}], \"cna\": {\"title\": \"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles\", \"source\": {\"advisory\": \"GHSA-5g9f-cwwg-4p8g\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"pontedilana\", \"product\": \"php-weasyprint\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.6.0\"}]}], \"references\": [{\"url\": \"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g\", \"name\": \"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4\", \"name\": \"https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391\", \"name\": \"https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0\", \"name\": \"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` \\u2014 invoked from `__destruct()` and from a registered shutdown function \\u2014 calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-73\", \"description\": \"CWE-73: External Control of File Name or Path\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-19T14:52:05.368Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-49358\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-23T02:09:16.687Z\", \"dateReserved\": \"2026-05-29T14:35:45.904Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-19T14:52:05.368Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-49358

Vulnerability from fkie_nvd - Published: 2026-06-19 15:16 - Updated: 2026-06-23 03:16

Severity

3.0 (Low) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4
	security-advisories@github.com	https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391
	security-advisories@github.com	https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0
	security-advisories@github.com	https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "php-weasyprint",
          "vendor": "pontedilana",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` \u2014 invoked from `__destruct()` and from a registered shutdown function \u2014 calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue."
    }
  ],
  "id": "CVE-2026-49358",
  "lastModified": "2026-06-23T03:16:41.250",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 3.0,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49358",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-23T02:08:49.575183Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-19T15:16:35.143",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5G9F-CWWG-4P8G

Vulnerability from github – Published: 2026-06-26 22:10 – Updated: 2026-06-26 22:10

Summary

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

Details

Summary

AbstractGenerator::$temporaryFiles is a public array, and removeTemporaryFiles() — invoked from __destruct() and from a registered shutdown function — calls unlink() on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.

This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4, patched in snappy 1.7.2.

Affected versions

pontedilana/php-weasyprint versions <= 2.5.1.

Patched in: 2.6.0.

Vulnerable code

src/AbstractGenerator.php:

public array $temporaryFiles = [];

// ...

public function removeTemporaryFiles(): void
{
    foreach ($this->temporaryFiles as $file) {
        $this->unlink($file);
    }
}

No path-containment check: whatever path is present in $temporaryFiles at shutdown is unlinked.

Proof of concept

<?php
use Pontedilana\PhpWeasyPrint\Pdf;

$pdf = new Pdf();
$pdf->temporaryFiles[] = '/var/www/html/.env';

// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.

Impact

Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.
Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is amplification: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.

CWE-73 (External Control of File Name or Path).

Suggested fix

Only delete files that actually live inside the temporary folder, comparing canonical (realpath) paths:

public function removeTemporaryFiles(): void
{
    $temporaryFolderPath = \realpath($this->getTemporaryFolder());
    if (false === $temporaryFolderPath) {
        return;
    }
    $temporaryFolderPath = \rtrim($temporaryFolderPath, \DIRECTORY_SEPARATOR) . \DIRECTORY_SEPARATOR;

    foreach ($this->temporaryFiles as $file) {
        $filePath = \realpath($file);
        if (false === $filePath || 0 !== \strncmp($filePath, $temporaryFolderPath, \strlen($temporaryFolderPath))) {
            continue;
        }
        $this->unlink($file);
    }
}

(The trailing directory separator prevents a sibling folder such as /tmpevil from matching /tmp; strncmp is used instead of str_starts_with to keep PHP 7.4 compatibility.)

Credit

Reported upstream to KnpLabs/snappy (GHSA-87qc-37cw-84h4); identified as applicable to pontedilana/php-weasyprint, which mirrors the same code.

Severity

3.0 (Low)


                  
                    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.5.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pontedilana/php-weasyprint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49358"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T22:10:51Z",
    "nvd_published_at": "2026-06-19T15:16:35Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\n`AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` \u2014 invoked from `__destruct()` and from a registered shutdown function \u2014 calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.\n\nThis mirrors the KnpLabs/snappy issue [GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4), patched in snappy 1.7.2.\n\n### Affected versions\n\n`pontedilana/php-weasyprint` versions `\u003c= 2.5.1`.\n\nPatched in: `2.6.0`.\n\n### Vulnerable code\n\n`src/AbstractGenerator.php`:\n\n```php\npublic array $temporaryFiles = [];\n\n// ...\n\npublic function removeTemporaryFiles(): void\n{\n    foreach ($this-\u003etemporaryFiles as $file) {\n        $this-\u003eunlink($file);\n    }\n}\n```\n\nNo path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked.\n\n### Proof of concept\n\n```php\n\u003c?php\nuse Pontedilana\\PhpWeasyPrint\\Pdf;\n\n$pdf = new Pdf();\n$pdf-\u003etemporaryFiles[] = \u0027/var/www/html/.env\u0027;\n\n// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.\n```\n\n### Impact\n\n- Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.\n- Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is **amplification**: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.\n\nCWE-73 (External Control of File Name or Path).\n\n### Suggested fix\n\nOnly delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths:\n\n```php\npublic function removeTemporaryFiles(): void\n{\n    $temporaryFolderPath = \\realpath($this-\u003egetTemporaryFolder());\n    if (false === $temporaryFolderPath) {\n        return;\n    }\n    $temporaryFolderPath = \\rtrim($temporaryFolderPath, \\DIRECTORY_SEPARATOR) . \\DIRECTORY_SEPARATOR;\n\n    foreach ($this-\u003etemporaryFiles as $file) {\n        $filePath = \\realpath($file);\n        if (false === $filePath || 0 !== \\strncmp($filePath, $temporaryFolderPath, \\strlen($temporaryFolderPath))) {\n            continue;\n        }\n        $this-\u003eunlink($file);\n    }\n}\n```\n\n(The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.)\n\n### Credit\n\nReported upstream to KnpLabs/snappy ([GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4)); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.",
  "id": "GHSA-5g9f-cwwg-4p8g",
  "modified": "2026-06-26T22:10:51Z",
  "published": "2026-06-26T22:10:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49358"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pontedilana/php-weasyprint"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-49358 (GCVE-0-2026-49358)

FKIE_CVE-2026-49358

GHSA-5G9F-CWWG-4P8G

Summary

Affected versions

Vulnerable code

Proof of concept

Impact

Suggested fix

Credit

Tags

Sightings

Nomenclature