Is there a patch available for EUVD-2026-36112?

Yes, a patch is available for EUVD-2026-36112. Update the affected software to the latest version immediately.

KnpLabs Snappy EUVD-2026-36112

Q: What is the CVSS score of EUVD-2026-36112?

EUVD-2026-36112 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-46683 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-21 https://github.com/KnpLabs/snappy

GHSA-c5fp-p67m-gq56

PHP SSRF

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 10, 2026 - 20:22 NVD

6.9 (MEDIUM)

Source Code Evidence Fetched

May 21, 2026 - 21:03 vuln.today

Analysis Generated

May 21, 2026 - 21:03 vuln.today

DescriptionNVD

Impact

It impacts applications where:

the PHP daemon run with root permissions ;
the application is either running outside a container or has sensitive file access ;

It could happens with this kind of workflows:

php

$stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
 $pdf->generate(‘page.html’, ‘out.pdf’, [
   ‘xsl-style-sheet’ => $stylesheet
 ]);

Patches

A list a schema with http and https by default is used to validate the remote path by default.

Workarounds

Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library.

php

// Bad example
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
 $pdf->generate(‘page.html’, ‘out.pdf’, [
   ‘xsl-style-sheet’ => $_GET['input'],
 ]);

Instead developers can list available available stylesheets and pick the right one with the user input.

php

// Better
$allowedStylesheets = [
    'invoice' => '/app/xsl/invoice.xsl',
    'report'  => '/app/xsl/report.xsl',
];

$key = $_GET['stylesheet'] ?? '';

if (!array_key_exists($key, $allowedStylesheets)) {
    throw new \RuntimeException('Unknown stylesheet.');
}

$pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf');
$pdf->generate('page.html', 'out.pdf', [
    'xsl-style-sheet' => $allowedStylesheets[$key],
]);

References

AnalysisAI

Server-Side Request Forgery (SSRF) and local file read in KnpLabs Snappy (composer package knplabs/knp-snappy <= 1.6.0) allows remote attackers to exfiltrate sensitive server files by injecting a file:// URI into the xsl-style-sheet PDF generation option. When applications pass unsanitized user input directly to the Snappy library's generate() method, wkhtmltopdf processes attacker-controlled URIs including file:// scheme paths, enabling reads of files such as /etc/passwd. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV, but the attack pattern is straightforward and exploitability is high in vulnerable deployments where PHP runs as root outside a container.

Technical ContextAI

KnpLabs Snappy is a PHP wrapper library around the wkhtmltopdf binary, used to generate PDFs and images from HTML. The affected component is the xsl-style-sheet option passed through Snappy's generate() method, which is forwarded as a command-line argument to wkhtmltopdf. The wkhtmltopdf binary supports multiple URI schemes including file://, which allows it to read local filesystem paths during XSL stylesheet processing. The root cause (CWE-918: Server-Side Request Forgery) is the absence of URI schema validation in Snappy prior to version 1.7.0 - user-supplied input could specify arbitrary URI schemes without restriction. The affected Composer package is pkg:composer/knplabs_knp-snappy, versions <= 1.6.0. The fix in 1.7.0 introduces a schema allowlist defaulting to http and https, blocking file://, ftp://, and other potentially dangerous schemes.

RemediationAI

Upgrade knplabs/knp-snappy to version 1.7.0 or later via Composer (composer require knplabs/knp-snappy:^1.7.0). Version 1.7.0 introduces a URI schema allowlist restricted to http and https by default, blocking file:// and other dangerous schemes before they reach wkhtmltopdf. As an application-level workaround where immediate patching is not possible, developers must never pass raw user input to the xsl-style-sheet option or any other Snappy option that accepts file or URI paths. Instead, implement a server-side allowlist mapping user-supplied keys to pre-approved absolute filesystem paths (e.g., mapping 'invoice' to '/app/xsl/invoice.xsl') and reject any key not present in the allowlist with a hard error. Note: this workaround requires code changes across all call sites and carries the operational risk of missing undiscovered call paths - patching to 1.7.0 is strongly preferred. The advisory and example code are at https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56.