Snappdf CVE-2026-110646

Requires all of: (1) the affected product runs on Windows, since only the executeOnWindows() code path builds a shell string passed to exec() - Linux/macOS use an argv array and are not vulnerable; (2) the host application passes attacker-influenced data into the setUrl() value (modeled as AT:P in the CVSS 4.0 vector), so a URL that is fully static/trusted is not exploitable; (3) an installed version in the range 1.1.0 through before 6.1.0. The injection uses cmd.exe metacharacters such as '&'. No authentication is required per PR:N. The limiting factors are the Windows-only platform dependency and the need for the integrating application to feed untrusted input into setUrl().

This is a genuine high-priority issue where exploitable, but its real-world reach is narrowed by two concrete gates. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with VC:H/VI:H/VA:H and the source-code diff both confirm unauthenticated remote OS command injection yielding full confidentiality, integrity and availability loss as the PHP process. However, the AT:P (attack requirement) metric is doing real work here: exploitation is only possible when the host application actually routes attacker-influenced data into setUrl(), and ONLY on Windows, where the removed executeOnWindows() built a shell string via exec(implode(' ', $commands)). On Linux/macOS the argv-based execution was never vulnerable, so the practical exploitable population is limited to Windows deployments that expose user-controlled URLs. No EPSS score was provided and the product is not in CISA KEV, and no POC is indicated in the input - so there is no public exploit identified at time of analysis. The vulnerability is confirmed by VulnCheck and the vendor patch/commit, so the technical reality is solid; the 9.2 score is defensible for affected Windows setups but overstates risk for the Linux/macOS majority of PHP deployments, which are unaffected.

A Windows-hosted PHP/Laravel application uses snappdf to render a user-supplied URL into a PDF and passes that URL to setUrl(). An unauthenticated attacker submits a value containing cmd.exe metacharacters (e.g. 'http://x/&calc.exe'), which executeOnWindows() concatenates and passes unescaped to PHP exec(), running arbitrary commands as the web/PHP process. No public exploit is identified at time of analysis; the flaw is fixed in 6.1.0 by executing the browser via a Symfony Process argv array that escapes arguments on Windows.