CVE-2026-46643: KnpLabs Snappy command injection via unescaped binary path

CVE-2026-46643 · Severity: high · CVSS 4 · Published 2026-06-10

KnpLabs Snappy is a PHP library used to generate PDFs and images from web pages. A security flaw allows attackers to execute unauthorized commands on the server if they can influence the configuration path of the underlying conversion tool. This could lead to a full system compromise or unauthorized access to sensitive data handled by the web application.

Technologies: knplabs/knp-snappy (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-46643 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46643 being exploited in the wild.
How severe is CVE-2026-46643?
High severity, with a CVSS score of 4, published 10 June 2026.
Which products and versions are affected?
KnpLabs Snappy <= 1.7.0; knplabs/knp-snappy (Packagist) <= 1.7.0, ECOSYSTEM:introduced=0,fixed=1.7.1.
Is there a fix for CVE-2026-46643?
Yes. knplabs/knp-snappy (Packagist): upgrade to 1.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46643 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-46643?
Check whether you run KnpLabs Snappy or knplabs/knp-snappy (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • knplabs/knp-snappy (Packagist): upgrade to 1.7.1 or later
    composer require knplabs/knp-snappy:^1.7.1

Technical details

A command injection vulnerability exists in KnpLabs Snappy prior to version 1.7.1 on POSIX systems. The library attempts to escape the binary path using escapeshellarg(), but subsequently checks the escaped string with is_executable(). Because is_executable() fails on the quoted string, the library falls back to using the raw, unescaped path. If an attacker can influence the binary path via configuration, environment variables, or request data, they can append malicious shell commands (e.g., using semicolons). This results in arbitrary command execution with the privileges of the PHP process. The issue is patched in version 1.7.1.

Affected products

  • KnpLabs knp-snappy <= 1.7.0

Identifiers

  • CVE-2026-46643
  • GHSA-vpr4-p6fq-85jc

Timeline

  • 2026-05-15: patched: Version 1.7.1 released
  • 2026-05-15: advisory: GitHub Security Advisory GHSA-vpr4-p6fq-85jc published
  • 2026-06-10: disclosed: CVE-2026-46643 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.