CVE-2026-49359

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49359", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-29T14:35:45.904Z", "datePublished": "2026-06-19T17:06:12.737Z", "dateUpdated": "2026-06-23T02:16:42.011Z"}, "containers": {"cna": {"title": "PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36"}, {"name": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56", "tags": ["x_refsource_MISC"], "url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56"}, {"name": "https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb", "tags": ["x_refsource_MISC"], "url": "https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb"}, {"name": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"}], "affected": [{"vendor": "pontedilana", "product": "php-weasyprint", "versions": [{"version": "< 2.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T17:06:12.737Z"}, "descriptions": [{"lang": "en", "value": "PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-x8g9-h984-pc36", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T02:15:43.408580Z", "id": "CVE-2026-49359", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T02:16:42.011Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49359", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T02:15:43.408580Z"}}}], "references": [{"url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T02:16:05.960Z"}}], "cna": {"title": "PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option", "source": {"advisory": "GHSA-x8g9-h984-pc36", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pontedilana", "product": "php-weasyprint", "versions": [{"status": "affected", "version": "< 2.6.0"}]}], "references": [{"url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36", "name": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56", "name": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb", "name": "https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0", "name": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T17:06:12.737Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49359", "state": "PUBLISHED", "dateUpdated": "2026-06-23T02:16:42.011Z", "dateReserved": "2026-05-29T14:35:45.904Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-19T17:06:12.737Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "php-weasyprint", "vendor": "pontedilana", "versions": [{"status": "affected", "version": "< 2.6.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue."}, {"lang": "es", "value": "PhpWeasyPrint es una biblioteca PHP que permite la generaci\u00f3n de PDF desde una URL o una p\u00e1gina HTML. Antes de la versi\u00f3n 2.6.0, \u2019pontedilana/php-weasyprint\u2019 obtiene el contenido de los valores de las opciones del lado del servidor a trav\u00e9s de \u2019file_get_contents()\u2019 cuando el valor parece una URL, sin restringir el esquema de la URL. La opci\u00f3n \u2019attachment\u2019 de \u2019Pdf\u2019 es el sumidero alcanzable: cualquier valor que pase \u2019isOptionUrl()\u2019 (\u2019filter_var(..., FILTER_VALIDATE_URL)\u2019) es descargado por el proceso PHP e incrustado en el PDF generado. Debido a que \u2019FILTER_VALIDATE_URL\u2019 acepta \u2019http\u2019, \u2019https\u2019, \u2019ftp\u2019, \u2019file\u2019 y envoltorios de flujo PHP como \u2019php://\u2019, un atacante que puede influir en el valor de \u2019attachment\u2019 alcanza tanto una primitiva de falsificaci\u00f3n de petici\u00f3n del lado del servidor (p. ej., puntos finales HTTP internos, metadatos de la nube) como una primitiva de divulgaci\u00f3n de archivos locales (\u2019file: //\u2019, \u2019php://filter/...\u2019), con los bytes obtenidos exfiltrados como un adjunto PDF. Esta es la misma clase de problema que KnpLabs/snappy parche\u00f3 para su opci\u00f3n \u2019xsl-style-sheet\u2019 en GHSA-c5fp-p67m-gq56. La biblioteca est\u00e1 documentada como un sustituto uno a uno de KnpLabs/snappy y comparte la misma forma de c\u00f3digo. PhpWeasyPrint versi\u00f3n 2.6.0 contiene un parche para el problema."}], "id": "CVE-2026-49359", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49359", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T02:15:43.408580Z", "version": "2.0.3"}}]}, "published": "2026-06-19T18:16:19.890", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56"}, {"source": "security-advisories@github.com", "url": "https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb"}, {"source": "security-advisories@github.com", "url": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "php-weasyprint", "source": "cna", "vendor": "pontedilana"}, "product": "php-weasyprint", "vendor": "pontedilana"}], "created": "2026-06-19T20:00:11.992429+00:00", "updated": "2026-06-20T22:34:58.545837+00:00", "vendors": ["pontedilana", "pontedilana$PRODUCT$php-weasyprint"]}