What is the CVSS score of CVE-2026-49260?

CVE-2026-49260 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PhpWeasyPrint are affected by CVE-2026-49260?

The php-weasyprint library versions prior to 2.5.1 contain a shell command injection vulnerability enabling arbitrary code execution within the PHP process, affecting organizations relying on this…. A patch is available.

Is there a public PoC exploit available for CVE-2026-49260?

Yes, a public proof-of-concept exploit is available for CVE-2026-49260. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-49260?

Within 24 hours: Identify all systems using pontedilana/php-weasyprint, document deployed versions, and review configurations for external WeasyPrint binary path sources. Within 7 days: Implement compensating controls including hardcoded binary path allowlists, restricted configuration handling, and process containerization; monitor for patch availability. Within 30 days: Apply vendor patch upon release (version 2.5.1 or later targeted) or transition to alternative document rendering solution.

PhpWeasyPrint CVE-2026-49260

EUVD-2026-38048 HIGH

OS Command Injection (CWE-78)

2026-06-19 security-advisories@github.com

GHSA-f5gc-qxf8-mh9g

PHP Command Injection

8.2

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Attacker needs write access to the binary configuration (PR:H, AV:L), execution as PHP user escapes the library trust boundary (S:C) with full C/I/A impact on the host process.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 19:02 EUVD

Source Code Evidence Fetched

Jun 19, 2026 - 17:31 vuln.today

Analysis Generated

Jun 19, 2026 - 17:31 vuln.today

DescriptionCVE.org

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, pontedilana/php-weasyprint builds the shell command for WeasyPrint by passing the binary path through escapeshellarg() first and then checking the *quoted* result with is_executable(). On POSIX escapeshellarg('/usr/local/bin/weasyprint') returns '/usr/local/bin/weasyprint' with the single-quote characters as part of the string, so is_executable() looks for a file whose actual name includes those quotes. That file never exists, the "safe" branch is dead code, and the raw $binary string (set via the constructor or setBinary()) flows directly into Symfony\Component\Process\Process::fromShellCommandline(). Any deployment whose binary path is sourced from configuration, an environment variable, or a per-tenant setting reaches a shell-command-injection sink. The library is documented as a one-to-one substitute for KnpLabs/snappy and inherited the exact pre-fix codepath KnpLabs patched in GHSA-vpr4-p6fq-85jc. PhpWeasyPrint version 2.5.1 contains a patch for the issue.

AnalysisAI

Shell command injection in pontedilana/php-weasyprint prior to 2.5.1 allows code execution as the PHP process when the WeasyPrint binary path is sourced from configuration, environment variables, or per-tenant settings. The library's buildCommand() inverted the order of escapeshellarg() and is_executable(), turning the 'safe' branch into dead code and passing the raw binary string into Symfony Process::fromShellCommandline(). No public exploit identified at time of analysis, but a PoC for the identical KnpLabs/snappy precursor flaw (GHSA-vpr4-p6fq-85jc) is published and directly applicable.

Technical ContextAI

PhpWeasyPrint is a PHP wrapper around the WeasyPrint HTML-to-PDF CLI, marketed as a drop-in replacement for KnpLabs/snappy. The defect is a CWE-78 OS Command Injection rooted in a logic error: escapeshellarg('/usr/local/bin/weasyprint') returns the path wrapped in literal single quotes, then is_executable() is asked whether a file literally named "'/usr/local/bin/weasyprint'" (quotes included) is executable. On POSIX that always returns false, so the ternary falls through to the unescaped $binary, which Symfony's Process::fromShellCommandline() then evaluates through /bin/sh -c. The downstream KnpLabs/snappy project patched the identical bug in 1.7.1 (GHSA-vpr4-p6fq-85jc); PhpWeasyPrint inherited the codepath verbatim. The 2.5.1 fix introduces getEscapedBinary() which calls is_executable() on the unescaped path first and throws RuntimeException before escaping.

RemediationAI

Vendor-released patch: upgrade pontedilana/php-weasyprint to 2.5.1 or later via composer update pontedilana/php-weasyprint (see https://github.com/pontedilana/php-weasyprint/releases/tag/2.5.1 and commit 9e86a2b317237fc5728f712f5037164530117f7e). If upgrade is not immediately possible, the vendor-recommended workaround mirrors the snappy guidance: validate the binary path with \is_executable($path) on the unescaped string before instantiating the generator, and reject any value that fails - note this only helps if the path is set in application code, not if it flows from runtime configuration. Additional compensating controls: remove tenant/operator write access to the binary path setting, hard-code the path in immutable application code or container image, and run the PHP-FPM process under a least-privileged UID with a restrictive AppArmor/SELinux profile so a successful injection cannot read tenant data or pivot.