What is the CVSS score of CVE-2026-49358?

CVE-2026-49358 has a CVSS 3.1 base score of 3.0 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-49358?

Yes, a public proof-of-concept exploit is available for CVE-2026-49358. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-49358?

Yes, a patch is available for CVE-2026-49358. Update the affected software to the latest version immediately.

PhpWeasyPrint CVE-2026-49358

EUVD-2026-38036 LOW

External Control of File Name or Path (CWE-73)

2026-06-19 GitHub_M

GHSA-5g9f-cwwg-4p8g

PHP RCE Php Weasyprint

3.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.0 LOW

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.0 LOW

Local code access and high privilege (PR:H) required to reference the generator instance; no confidentiality impact; limited integrity and availability from file deletion only.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 19, 2026 - 16:01 EUVD

Source Code Evidence Fetched

Jun 19, 2026 - 15:32 vuln.today

Analysis Generated

Jun 19, 2026 - 15:32 vuln.today

DescriptionCVE.org

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, AbstractGenerator::$temporaryFiles is a public array, and removeTemporaryFiles() - invoked from __destruct() and from a registered shutdown function - calls unlink() on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

AnalysisAI

Arbitrary file deletion in PhpWeasyPrint prior to version 2.6.0 allows any code holding a reference to a generator instance to inject arbitrary filesystem paths into the public AbstractGenerator::$temporaryFiles array, which are then passed to unlink() without path-containment validation during script shutdown or object destruction. The vulnerability mirrors a previously disclosed pattern in the related KnpLabs/snappy library (GHSA-87qc-37cw-84h4), and is exploitable by malicious dependencies, plugin code, or any PHP code co-located in the same process with access to the generator object. No public exploit has been identified at time of analysis, and exploitation is substantially constrained by the requirement for high privileges and local code access.

Technical ContextAI

PhpWeasyPrint (cpe:2.3:a:pontedilana:php-weasyprint:*:*:*:*:*:*:*:*) is a PHP wrapper around the WeasyPrint binary used to render PDFs from HTML or URLs. The root cause is CWE-73 (External Control of File Name or Path): the $temporaryFiles property is declared public, and the cleanup routine removeTemporaryFiles() - invoked both from __destruct() and a registered PHP shutdown function - iterates the array and calls unlink() on each entry without first resolving the real path and confirming it resides within the designated temporary directory. PHP's realpath() is the standard mitigation, and the patch in commit 6d328ffd confirms this: it resolves the temporary folder via realpath(), strips trailing separators, and uses strncmp() to enforce a prefix check before any unlink() call is made. The shutdown-function registration means the attack window extends to the full PHP process lifetime, not just object scope.

RemediationAI

The primary fix is to upgrade pontedilana/php-weasyprint to version 2.6.0, which introduces path-containment validation in removeTemporaryFiles() via realpath() and strncmp() prefix enforcement. The patch commit is available at https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391 and the release at https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0. If immediate upgrade is not feasible, a compensating control is to audit all Composer dependencies for code that accesses generator instances directly and restrict the visibility surface by wrapping generator usage in a factory pattern that prevents external reference acquisition. Note that changing $temporaryFiles visibility in application code without patching the library does not prevent exploitation by third-party packages that access the property via reflection. There are no known configuration-level workarounds that eliminate the risk without upgrading.