CVE-2026-49358 PUBLISHED

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

Assigner: GitHub_M
Reserved: 29.05.2026 Published: 19.06.2026 Updated: 19.06.2026

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, AbstractGenerator::$temporaryFiles is a public array, and removeTemporaryFiles() — invoked from __destruct() and from a registered shutdown function — calls unlink() on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 3

Product Status

Vendor pontedilana
Product php-weasyprint
Versions
  • Version < 2.6.0 is affected

References

Problem Types

  • CWE-73: External Control of File Name or Path CWE