PhpWeasyPrint versions before 2.5.1 improperly neutralize special elements in the OS command used to invoke the WeasyPrint binary. The library attempts to validate the binary path by quoting it with escapeshellarg() and then checking its executability with is_executable(), but this check fails because the quotes become part of the filename. Consequently, the validation is bypassed, and the raw binary path string, which may come from configuration or environment variables, is passed directly to Symfony's Process::fromShellCommandline(), enabling OS command injection. The vulnerability is fixed in version 2.5.1.

Successful exploitation allows an attacker with high privileges (local access with high privileges) to execute arbitrary OS commands with the privileges of the php-weasyprint process. This can lead to complete system compromise, including confidentiality, integrity, and availability impacts. The vulnerability requires local access and high privileges but does not require user interaction.

A fix is available in php-weasyprint version 2.5.1. Users should upgrade to version 2.5.1 or later to remediate this vulnerability. Until upgraded, avoid sourcing the binary path from untrusted configuration or environment variables to reduce risk.