Executive brief
A vulnerability in the php-weasyprint library, which is used to generate PDF files from web content, allows for unauthorized command execution on the server. If an attacker can influence the configuration settings that define where the WeasyPrint software is located, they can execute arbitrary commands with the same permissions as the web application. This could lead to a full system compromise, data theft, or service disruption.
Technical details
The vulnerability exists in `AbstractGenerator::buildCommand` and `Pdf::buildCommand` due to an inverted logic check using `is_executable()`. The code passes the binary path through `escapeshellarg()` and then checks if the resulting quoted string is executable. On POSIX systems, this check always fails because the literal quotes are included in the filename lookup. Consequently, the code falls back to using the raw, unescaped `$binary` string in a call to `Symfony\Component\Process\Process::fromShellCommandline()`. An attacker who can control the binary path via configuration files, environment variables, or administrative interfaces can inject shell metacharacters to achieve remote code execution. This issue is a regression of a similar flaw patched in the KnpLabs/snappy library (GHSA-vpr4-p6fq-85jc).
Affected products
- pontedilana php-weasyprint <= 2.5.0
Timeline
- 2026-04-03: other: Vulnerable tip commit identified
- 2026-05-25: disclosed: Vulnerability reported by tonghuaroot
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched: Fixed in version 2.5.1