Which versions of KnpLabs Snappy are affected by EUVD-2026-36111?

KnpLabs Snappy PHP library (versions ≤1.7.0) contains a command injection vulnerability allowing arbitrary OS command execution on affected servers.. A patch is available.

How to fix or mitigate EUVD-2026-36111?

Within 24 hours: Identify all systems running KnpLabs Snappy ≤1.7.0 and restrict access to document generation functionality. Within 7 days: Apply vendor patch to upgrade beyond version 1.7.0; conduct full application testing in staging. Within 30 days: Complete production deployment and monitor application logs for exploitation indicators.

KnpLabs Snappy EUVD-2026-36111

Q: What is the CVSS score of EUVD-2026-36111?

EUVD-2026-36111 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-46643 HIGH

OS Command Injection (CWE-78)

2026-05-21 https://github.com/KnpLabs/snappy

GHSA-vpr4-p6fq-85jc

PHP Command Injection

7.5

CVSS 4.0 · Vendor: https://github.com/KnpLabs/snappy

Severity by source

Vendor (https://github.com/KnpLabs/snappy) PRIMARY

7.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Requires attacker influence over the Snappy binary path configuration (PR:H, AC:H for the non-default tainted-path precondition); local vector matches the library API surface; full C/I/A impact via code execution as the PHP process.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (https://github.com/KnpLabs/snappy).

CVSS VectorVendor: https://github.com/KnpLabs/snappy

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 10, 2026 - 20:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 10, 2026 - 20:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 10, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

Source Code Evidence Fetched

May 21, 2026 - 21:00 vuln.today

Analysis Generated

May 21, 2026 - 21:00 vuln.today

DescriptionCVE.org

Impact

On POSIX, escapeshellarg(‘/usr/bin/wkhtmltopdf’) returns the literal string ‘/usr/bin/wkhtmltopdf’ with the single-quote characters included. is_executable() then looks for a file whose actual name contains those quote characters, which essentially never exists. The safe branch is dead code and $command always falls through to the raw, unescaped value.

The rest of the arguments (options, input, output) are escaped correctly, so injection has to land in the binary string itself. That happens whenever the binary path is sourced from configuration that is user-influenced, derived from environment variables that ultimately come from request data, or concatenated with any user-controlled fragment.

Proof of concept:

php

 $pdf = new Knp\Snappy\Pdf(‘wkhtmltopdf; touch /tmp/snappy_rce’);
 $pdf->generate(‘https://example.com’, ‘/tmp/out.pdf’);
 // /tmp/snappy_rce is created.

Impact: command execution as the PHP process when the binary path is attacker-influenced. Even in deployments where the binary is hard-coded, this is a defensive-in-depth regression: downstream packages reasonably assume Snappy shell-escapes the binary because the code looks like it does.

Patches

The version 1.7.1 will resolve this security advisory.

Workarounds

Before calling the constructor, ensure \is_executable($path) is truthy.

php

// Bad example
$pdf = new Knp\Snappy\Pdf('/path/to/binary');

php

// Better example
$pathToBinary = '/path/to/binary';

if (!\is_executable($pathToBinary)) {
  throw new \RuntimeException();
}

$pdf = new Knp\Snappy\Pdf('/path/to/binary');

AnalysisAI

Command injection in KnpLabs Snappy PHP library (versions <= 1.7.0) allows attackers to execute arbitrary OS commands when the wkhtmltopdf/wkhtmltoimage binary path is attacker-influenced. An inverted is_executable() check around escapeshellarg() renders the safe branch dead code, causing the binary path to be concatenated unescaped into the shell command. Publicly available exploit code exists (vendor-published PoC in the advisory), but no public exploit identified at time of analysis in CISA KEV.

Technical ContextAI

Snappy is a widely used PHP wrapper around the wkhtmltopdf and wkhtmltoimage binaries for generating PDFs and images from HTML. The root cause maps to CWE-78 (OS Command Injection): the library wraps the binary path with escapeshellarg() and then guards selection of the escaped value behind is_executable() - but on POSIX systems escapeshellarg('/usr/bin/wkhtmltopdf') returns the path wrapped in literal single quotes, so is_executable() is called against a path that includes those quote characters and always returns false. The safe branch is therefore unreachable, and the raw, unescaped binary string is interpolated into the shell command line. The affected package is identified as pkg:composer/knplabs_knp-snappy in CPE data.

RemediationAI

Vendor-released patch: upgrade knplabs/knp-snappy to 1.7.1 or later via Composer (composer require knplabs/knp-snappy:^1.7.1), per the release notes at https://github.com/KnpLabs/snappy/releases/tag/v1.7.1 and the GHSA at https://github.com/KnpLabs/snappy/security/advisories/GHSA-vpr4-p6fq-85jc; note the v1.7.1 changelog warns that the fix also prevents passing arguments directly via the binary string (issue #550), so any code that relied on appending flags to the binary path must be refactored to use the proper option APIs. If immediate upgrade is not possible, the vendor-recommended workaround is to validate the binary path with \is_executable($pathToBinary) and throw before constructing Knp\Snappy\Pdf or Image, which closes the injection only when the path is not attacker-controlled - it does not help if an attacker can write a malicious file at a valid executable path. As a stronger compensating control, hard-code the binary path as a constant in code (not configuration, not env) and ensure no user input is ever concatenated into it; the trade-off is reduced deployment flexibility across environments with differing binary locations.