CVE-2026-49286— PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pontedilana | php-weasyprint | < 2.6.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49286
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Source: NVD (National Vulnerability Database)
Vulnerability Description
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| pontedilana | php-weasyprint | < 2.6.0 | - |
II. Public POCs for CVE-2026-49286
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49286
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-49286 (1)
Vendor Advisories for CVE-2026-49286 (2)
Other References for CVE-2026-49286 (1)
- 🔗 Release 2.6.0 · pontedilana/php-weasyprint · GitHubx_refsource_MISC
Same Patch Batch · pontedilana · 2026-06-19 · 4 CVEs total
| CVE-2026-49260 | 8.2 HIGH | PhpWeasyPrint: shell command injection via configurable WeasyPrint binary path due to inve |
| CVE-2026-49359 | 6.5 MEDIUM | PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option |
| CVE-2026-49358 | 3.0 LOW | PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles |
IV. Related Vulnerabilities
Same weakness: CWE-502
- CVE-2026-57677
WordPress Novalnet Payment Gateway for WooCommerce plugin <= - CVE-2026-57621
WordPress Booktics plugin <= 1.0.21 - PHP Object Injection v - CVE-2026-27414
WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vu - CVE-2026-27060
WordPress ARMember Premium plugin <= 7.0 - PHP Object Inject - CVE-2026-55153
mchange-commons-java contains elements susceptible to abuse
V. Comments for CVE-2026-49286
No comments yet