{"id":"CVE-2026-49359","state":"PUBLISHED","title":"PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option","description":"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue.","publishedAt":"2026-06-19T17:06:12.737Z","updatedAt":"2026-06-23T02:16:42.011Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["pontedilana php-weasyprint"],"affected":[{"vendor":"pontedilana","product":"php-weasyprint","versions":[{"version":"< 2.6.0","status":"affected"}]}],"references":["https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36","https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56","https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb","https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/49xxx/CVE-2026-49359.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-49359","state":"PUBLISHED","datePublished":"2026-06-19T17:06:12.737Z","dateUpdated":"2026-06-23T02:16:42.011Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-05-29T14:35:45.904Z"},"containers":{"cna":{"title":"PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option","descriptions":[{"lang":"en","value":"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue."}],"affected":[{"vendor":"pontedilana","product":"php-weasyprint","versions":[{"version":"< 2.6.0","status":"affected"}]}],"references":[{"url":"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36","name":"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56","name":"https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56","tags":["x_refsource_MISC"]},{"url":"https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb","name":"https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb","tags":["x_refsource_MISC"]},{"url":"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0","name":"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","lang":"en","description":"CWE-918: Server-Side Request Forgery (SSRF)","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-06-19T17:06:12.737Z"},"source":{"advisory":"GHSA-x8g9-h984-pc36","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-23T02:15:43.408580Z","id":"CVE-2026-49359","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-23T02:16:42.011Z"}}]}}}