CVE-2026-49359

{
  "id": "CVE-2026-49359",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-19T18:16:19.890",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without restricting the URL scheme. The `attachment` option of `Pdf` is the reachable sink: any value that passes `isOptionUrl()` (`filter_var(..., FILTER_VALIDATE_URL)`) is downloaded by the PHP process and embedded into the generated PDF. Because `FILTER_VALIDATE_URL` accepts `http`, `https`, `ftp`, `file` and PHP stream wrappers such as `php://`, an attacker who can influence the `attachment` value reaches both a **Server-Side Request Forgery** primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive (`file://`, `php://filter/...`), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its `xsl-style-sheet` option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue."
    },
    {
      "lang": "es",
      "value": "PhpWeasyPrint es una biblioteca PHP que permite la generación de PDF desde una URL o una página HTML. Antes de la versión 2.6.0, ’pontedilana/php-weasyprint’ obtiene el contenido de los valores de las opciones del lado del servidor a través de ’file_get_contents()’ cuando el valor parece una URL, sin restringir el esquema de la URL. La opción ’attachment’ de ’Pdf’ es el sumidero alcanzable: cualquier valor que pase ’isOptionUrl()’ (’filter_var(..., FILTER_VALIDATE_URL)’) es descargado por el proceso PHP e incrustado en el PDF generado. Debido a que ’FILTER_VALIDATE_URL’ acepta ’http’, ’https’, ’ftp’, ’file’ y envoltorios de flujo PHP como ’php://’, un atacante que puede influir en el valor de ’attachment’ alcanza tanto una primitiva de falsificación de petición del lado del servidor (p. ej., puntos finales HTTP internos, metadatos de la nube) como una primitiva de divulgación de archivos locales (’file: //’, ’php://filter/...’), con los bytes obtenidos exfiltrados como un adjunto PDF. Esta es la misma clase de problema que KnpLabs/snappy parcheó para su opción ’xsl-style-sheet’ en GHSA-c5fp-p67m-gq56. La biblioteca está documentada como un sustituto uno a uno de KnpLabs/snappy y comparte la misma forma de código. PhpWeasyPrint versión 2.6.0 contiene un parche para el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pontedilana",
          "product": "php-weasyprint",
          "versions": [
            {
              "version": "< 2.6.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T02:15:43.408580Z",
          "id": "CVE-2026-49359",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}