CVE-2026-49358: CWE-73: External Control of File Name or Path in pontedilana php-weasyprint
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.
AI Analysis
Technical Summary
PhpWeasyPrint is a PHP library for generating PDFs from URLs or HTML pages. In versions before 2.6.0, the public array AbstractGenerator::$temporaryFiles can be manipulated by any code holding a reference to the generator instance. The removeTemporaryFiles() method, called on object destruction and shutdown, calls unlink() on all paths in this array without verifying they reside in the intended temporary folder. This allows external control of file paths leading to potential arbitrary file deletion. Version 2.6.0 includes a patch that addresses this vulnerability.
Potential Impact
An attacker with the ability to manipulate the generator instance can cause deletion of arbitrary files on the filesystem when the script terminates. The impact is limited to local file deletion and requires high privileges to exploit. Confidentiality is not affected, but integrity and availability may be impacted due to file deletion.
Mitigation Recommendations
Upgrade to PhpWeasyPrint version 2.6.0 or later, which contains a patch fixing this vulnerability. No other official remediation or temporary fixes are documented. Until upgrading, avoid exposing the AbstractGenerator::$temporaryFiles array to untrusted code.
CVE-2026-49358: CWE-73: External Control of File Name or Path in pontedilana php-weasyprint
Description
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.
CVSS v3.1
Score 3.0low
Affected software
pkg:composer/pontedilana/php-weasyprintRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PhpWeasyPrint is a PHP library for generating PDFs from URLs or HTML pages. In versions before 2.6.0, the public array AbstractGenerator::$temporaryFiles can be manipulated by any code holding a reference to the generator instance. The removeTemporaryFiles() method, called on object destruction and shutdown, calls unlink() on all paths in this array without verifying they reside in the intended temporary folder. This allows external control of file paths leading to potential arbitrary file deletion. Version 2.6.0 includes a patch that addresses this vulnerability.
Potential Impact
An attacker with the ability to manipulate the generator instance can cause deletion of arbitrary files on the filesystem when the script terminates. The impact is limited to local file deletion and requires high privileges to exploit. Confidentiality is not affected, but integrity and availability may be impacted due to file deletion.
Mitigation Recommendations
Upgrade to PhpWeasyPrint version 2.6.0 or later, which contains a patch fixing this vulnerability. No other official remediation or temporary fixes are documented. Until upgrading, avoid exposing the AbstractGenerator::$temporaryFiles array to untrusted code.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-29T14:35:45.904Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a355aaef198dc38c1711ecc
Added to database: 06/19/2026, 15:05:18 UTC
Last enriched: 06/26/2026, 19:14:42 UTC
Last updated: 08/03/2026, 07:17:57 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.