CVE-2026-49358: Pontedilana/php weasyprint PhpWeasyPrint Vulnerable To Arbitrary File Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5g9f-cwwg-4p8g",
  "modified" : "2026-06-26T22:10:51Z",
  "published" : "2026-06-26T22:10:51Z",
  "aliases" : [ "CVE-2026-49358" ],
  "summary" : "PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles",
  "details" : "### Summary\n\n`AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.\n\nThis mirrors the KnpLabs/snappy issue [GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4), patched in snappy 1.7.2.\n\n### Affected versions\n\n`pontedilana/php-weasyprint` versions `<= 2.5.1`.\n\nPatched in: `2.6.0`.\n\n### Vulnerable code\n\n`src/AbstractGenerator.php`:\n\n```php\npublic array $temporaryFiles = [];\n\n// ...\n\npublic function removeTemporaryFiles(): void\n{\n    foreach ($this->temporaryFiles as $file) {\n        $this->unlink($file);\n    }\n}\n```\n\nNo path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked.\n\n### Proof of concept\n\n```php\n<?php\nuse Pontedilana\\PhpWeasyPrint\\Pdf;\n\n$pdf = new Pdf();\n$pdf->temporaryFiles[] = '/var/www/html/.env';\n\n// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.\n```\n\n### Impact\n\n- Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.\n- Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is **amplification**: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.\n\nCWE-73 (External Control of File Name or Path).\n\n### Suggested fix\n\nOnly delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths:\n\n```php\npublic function removeTemporaryFiles(): void\n{\n    $temporaryFolderPath = \\realpath($this->getTemporaryFolder());\n    if (false === $temporaryFolderPath) {\n        return;\n    }\n    $temporaryFolderPath = \\rtrim($temporaryFolderPath, \\DIRECTORY_SEPARATOR) . \\DIRECTORY_SEPARATOR;\n\n    foreach ($this->temporaryFiles as $file) {\n        $filePath = \\realpath($file);\n        if (false === $filePath || 0 !== \\strncmp($filePath, $temporaryFolderPath, \\strlen($temporaryFolderPath))) {\n            continue;\n        }\n        $this->unlink($file);\n    }\n}\n```\n\n(The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.)\n\n### Credit\n\nReported upstream to KnpLabs/snappy ([GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4)); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "pontedilana/php-weasyprint"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.6.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.5.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-49358"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pontedilana/php-weasyprint"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-73" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-26T22:10:51Z",
    "nvd_published_at" : "2026-06-19T15:16:35Z"
  }
}