EUVD-2026-38036Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Local code access and high privilege (PR:H) required to reference the generator instance; no confidentiality impact; limited integrity and availability from file deletion only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, AbstractGenerator::$temporaryFiles is a public array, and removeTemporaryFiles() - invoked from __destruct() and from a registered shutdown function - calls unlink() on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.
AnalysisAI
Arbitrary file deletion in PhpWeasyPrint prior to version 2.6.0 allows any code holding a reference to a generator instance to inject arbitrary filesystem paths into the public AbstractGenerator::$temporaryFiles array, which are then passed to unlink() without path-containment validation during script shutdown or object destruction. The vulnerability mirrors a previously disclosed pattern in the related KnpLabs/snappy library (GHSA-87qc-37cw-84h4), and is exploitable by malicious dependencies, plugin code, or any PHP code co-located in the same process with access to the generator object. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker's code runs within the same PHP process as the PhpWeasyPrint generator instance and can obtain a reference to that instance object. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 3.0 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) accurately reflects the constrained threat model: exploitation requires local code-level access to the PHP process and high privilege (the ability to reference or inject into the generator object), making this a low-priority issue in isolation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised Composer package installed alongside PhpWeasyPrint obtains a reference to a generator instance during the application's normal PDF rendering flow, then appends a sensitive file path (such as a configuration file or database credential file) to `$temporaryFiles`. When the PHP script completes - either via normal termination or via the registered shutdown function - `removeTemporaryFiles()` iterates the array and calls `unlink()` on the injected path, silently deleting it without any path-safety check. … |
| Remediation | The primary fix is to upgrade pontedilana/php-weasyprint to version 2.6.0, which introduces path-containment validation in `removeTemporaryFiles()` via `realpath()` and `strncmp()` prefix enforcement. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stored cross-site scripting in the StarCitizenWiki EmbedVideo MediaWiki extension (versions <= 4.0.0) allows any user wi
Unrestricted PHP file upload in the MagicForm WordPress plugin (through version 0.1.3) enables unauthenticated remote co
Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through
Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the eve
Unauthenticated PHP Object Injection in the ThemeREX Hot Coffee WordPress theme (versions ≤ 1.7) allows remote attackers
Share
External POC / Exploit Code
Leaving vuln.today