Executive brief
PhpWeasyPrint is a library used to generate PDF files from HTML. A security flaw allows an attacker to execute malicious code on the server if they can control the output filename and upload a specially crafted file. This could lead to a full system compromise, though it primarily affects older environments running PHP versions earlier than 8.0.
Technical details
PhpWeasyPrint versions up to 2.5.1 are vulnerable to PHAR deserialization, a bypass of the previous fix for CVE-2023-28115. The library attempted to block the 'phar://' stream wrapper using a case-sensitive check with strpos(). Because PHP stream wrappers are case-insensitive, an attacker can bypass this check using variations like 'PHAR://'. When the library calls file_exists() on such a path in AbstractGenerator::prepareOutput(), it triggers the deserialization of PHAR metadata. If the application is running on PHP < 8.0 and suitable gadget chains are present in the project's dependencies, an attacker can achieve remote code execution. This requires the attacker to be able to influence the output filename and have a method to place a malicious PHAR file on the local filesystem. The issue is fixed in version 2.6.0 by implementing a protocol allow-list.
Affected products
- pontedilana php-weasyprint <= 2.5.1
Timeline
- 2026-05-25: disclosed: Advisory published by endelwar
- 2026-06-19: advisory: NVD published CVE-2026-49286
- 2026-06-26: advisory: GitHub Advisory Database entry updated
References
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj
- https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-2fmj-p74r-3wjm
- https://github.com/pontedilana/php-weasyprint/commit/d1aa487722b5a3cab9b222b85fdb5608a5a550c3
- https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0
- https://api.github.com/repos/pontedilana/php-weasyprint/security-advisories/GHSA-2fmj-p74r-3wjm