CVE-2026-49260 is an OS command injection vulnerability in pontedilana/php-weasyprint versions prior to 2.5.1. The library attempts to sanitize the WeasyPrint binary path by using escapeshellarg() and then verifying its executability with is_executable(). However, escapeshellarg() adds single quotes around the path, causing is_executable() to check a non-existent file with quotes in its name. This results in the safe code path never executing, and the raw binary path string is passed directly to Symfony\Component\Process\Process::fromShellCommandline(), which executes it in a shell context. If the binary path is sourced from configuration, environment variables, or tenant-specific settings, this leads to a shell command injection vulnerability. The issue was patched in version 2.5.1.

An attacker with high privileges who can influence the binary path configuration can execute arbitrary shell commands on the host system. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 score of 8.2 (high severity), reflecting its potential for significant impact. There are no known exploits in the wild at this time.

Upgrade to php-weasyprint version 2.5.1 or later, which contains a patch for this vulnerability. Until upgraded, ensure that the binary path configuration cannot be influenced by untrusted sources. Patch status is not explicitly stated as 'official-fix' but the vendor has released version 2.5.1 containing the fix, so upgrading is the recommended remediation.