Executive brief
Snappy is a PHP library used by developers to convert web pages into PDF documents or images. A security flaw allows attackers to trick the server into reading private internal files or making unauthorized requests to other internal systems. This could lead to the exposure of sensitive configuration data or credentials, especially if the application is running with high system privileges.
Technical details
A Server-Side Request Forgery (SSRF) and local file read vulnerability exists in the KnpLabs Snappy PHP library when processing the 'xsl-style-sheet' option. The root cause is insufficient validation of user-supplied paths or URLs passed to this option, which is subsequently processed by the underlying wkhtmltopdf engine. An attacker can provide a 'file://' URI to read sensitive local files (such as /etc/passwd) or use other protocols to probe internal network services. The impact is heightened if the PHP process runs with elevated privileges or has access to sensitive host files outside of a containerized environment. This issue is resolved in version 1.7.0 by implementing a default allowlist for URI schemes (http and https).
Affected products
- KnpLabs Snappy (knplabs/knp-snappy) <= 1.6.0
Timeline
- 2026-05-15: patched: Version 1.7.0 released
- 2026-05-15: advisory: GitHub Security Advisory GHSA-c5fp-p67m-gq56 published
- 2026-06-10: disclosed: CVE-2026-46683 published to NVD