Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-49260— PhpWeasyPrint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Quick assessment

Affected

pontedilana php-weasyprint

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pontedilana PhpWeasyPrint是Pontedilana公司开源的一个 PHP 库，作为 WeasyPrint 的封装器，支持从 URL 或 HTML 页面生成 PDF 文档，API 设计兼容 KnpLabs/snappy。 Pontedilana PhpWeasyPrint 2.5.1之前版本存在命令注入漏洞，该漏洞源于在构建WeasyPrint的shell命令时，二进制路径检查存在缺陷，导致未经处理的$binary字符串直接进入shell命令执行，可能导致命令注入攻击。

CVSS 8.2 · High EPSS 0.21% · P11 Updated Jun 27, 2026

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

Vendor	Product	Version Range	Status
pontedilana	php-weasyprint	`< 2.5.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49260

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PhpWeasyPrint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Source: CVE Program / CVE List V5

Vulnerability Description

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escapeshellarg('/usr/local/bin/weasyprint')` returns `'/usr/local/bin/weasyprint'` with the single-quote characters as part of the string, so `is_executable()` looks for a file whose actual name includes those quotes. That file never exists, the "safe" branch is dead code, and the raw `$binary` string (set via the constructor or `setBinary()`) flows directly into `Symfony\Component\Process\Process::fromShellCommandline()`. Any deployment whose binary path is sourced from configuration, an environment variable, or a per-tenant setting reaches a shell-command-injection sink. The library is documented as a one-to-one substitute for KnpLabs/snappy and inherited the exact pre-fix codepath KnpLabs patched in GHSA-vpr4-p6fq-85jc. PhpWeasyPrint version 2.5.1 contains a patch for the issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Vulnerability Title

Pontedilana PhpWeasyPrint 命令注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pontedilana	php-weasyprint	< 2.5.1	-

II. Public POCs for CVE-2026-49260

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

Qwen3.6-35B-A3B · 12541 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-49260

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49260 (1)

🔗 fix: ensure binary is executable in buildCommand · pontedilana/php-weasyprint@9e86a2b · GitHub Read full article x_refsource_MISC

Vendor Advisories for CVE-2026-49260 (2)

Vendor Pages for CVE-2026-49260 (1)

🔗 Release 2.5.1 · pontedilana/php-weasyprint · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-49260

Same Patch Batch · pontedilana · 2026-06-19 · 4 CVEs total

CVE-2026-49286	8.1 HIGH	PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-
CVE-2026-49359	6.5 MEDIUM	PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
CVE-2026-49358	3.0 LOW	PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

IV. Related Vulnerabilities

Same product: php-weasyprint

Same vendor: pontedilana

Same weakness: CWE-78