CVE-2026-49260: pontedilana php-weasyprint shell command injection in binary path validation

CVE-2026-49260 · Severity: high · CVSS 8.2 · Published 2026-06-19

A vulnerability in the php-weasyprint library, which is used to generate PDF files from web content, allows for unauthorized command execution on the server. If an attacker can influence the configuration settings that define where the WeasyPrint software is located, they can execute arbitrary commands with the same permissions as the web application. This could lead to a full system compromise, data theft, or service disruption.

Technologies: pontedilana/php-weasyprint (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-49260 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49260 being exploited in the wild.
How severe is CVE-2026-49260?
High severity, with a CVSS score of 8.2, published 19 June 2026.
Which products and versions are affected?
pontedilana/php-weasyprint (Packagist) <= 2.5.0, ECOSYSTEM:introduced=0,fixed=2.5.1.
Is there a fix for CVE-2026-49260?
Yes. pontedilana/php-weasyprint (Packagist): upgrade to 2.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49260 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-49260?
Check whether you run pontedilana/php-weasyprint (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pontedilana/php-weasyprint (Packagist): upgrade to 2.5.1 or later
    composer require pontedilana/php-weasyprint:^2.5.1

Technical details

The vulnerability exists in `AbstractGenerator::buildCommand` and `Pdf::buildCommand` due to an inverted logic check using `is_executable()`. The code passes the binary path through `escapeshellarg()` and then checks if the resulting quoted string is executable. On POSIX systems, this check always fails because the literal quotes are included in the filename lookup. Consequently, the code falls back to using the raw, unescaped `$binary` string in a call to `Symfony\Component\Process\Process::fromShellCommandline()`. An attacker who can control the binary path via configuration files, environment variables, or administrative interfaces can inject shell metacharacters to achieve remote code execution. This issue is a regression of a similar flaw patched in the KnpLabs/snappy library (GHSA-vpr4-p6fq-85jc).

Affected products

  • pontedilana php-weasyprint <= 2.5.0

Identifiers

  • CVE-2026-49260
  • GHSA-f5gc-qxf8-mh9g

Timeline

  • 2026-04-03: other: Vulnerable tip commit identified
  • 2026-05-25: disclosed: Vulnerability reported by tonghuaroot
  • 2026-06-26: advisory: GitHub Advisory published
  • 2026-06-26: patched: Fixed in version 2.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.