CVE-2026-46683: KnpLabs Snappy SSRF and local file read in xsl-style-sheet option

CVE-2026-46683 · Severity: medium · CVSS 4 · Published 2026-06-10

Snappy is a PHP library used by developers to convert web pages into PDF documents or images. A security flaw allows attackers to trick the server into reading private internal files or making unauthorized requests to other internal systems. This could lead to the exposure of sensitive configuration data or credentials, especially if the application is running with high system privileges.

Technologies: knplabs/knp-snappy (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-46683 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46683 being exploited in the wild.
How severe is CVE-2026-46683?
Medium severity, with a CVSS score of 4, published 10 June 2026.
Which products and versions are affected?
KnpLabs Snappy <= 1.6.0; knplabs/knp-snappy (Packagist) <= 1.6.0, ECOSYSTEM:introduced=0,fixed=1.7.0.
Is there a fix for CVE-2026-46683?
Yes. knplabs/knp-snappy (Packagist): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46683 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46683?
Check whether you run KnpLabs Snappy or knplabs/knp-snappy (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • knplabs/knp-snappy (Packagist): upgrade to 1.7.0 or later
    composer require knplabs/knp-snappy:^1.7.0

Technical details

A Server-Side Request Forgery (SSRF) and local file read vulnerability exists in the KnpLabs Snappy PHP library when processing the 'xsl-style-sheet' option. The root cause is insufficient validation of user-supplied paths or URLs passed to this option, which is subsequently processed by the underlying wkhtmltopdf engine. An attacker can provide a 'file://' URI to read sensitive local files (such as /etc/passwd) or use other protocols to probe internal network services. The impact is heightened if the PHP process runs with elevated privileges or has access to sensitive host files outside of a containerized environment. This issue is resolved in version 1.7.0 by implementing a default allowlist for URI schemes (http and https).

Affected products

  • KnpLabs Snappy (knplabs/knp-snappy) <= 1.6.0

Identifiers

  • CVE-2026-46683
  • GHSA-c5fp-p67m-gq56

Timeline

  • 2026-05-15: patched: Version 1.7.0 released
  • 2026-05-15: advisory: GitHub Security Advisory GHSA-c5fp-p67m-gq56 published
  • 2026-06-10: disclosed: CVE-2026-46683 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.