CVE-2026-49286: pontedilana php-weasyprint deserialization bypass in prepareOutput

CVE-2026-49286 · Severity: high · CVSS 8.1 · Published 2026-06-19

PhpWeasyPrint is a library used to generate PDF files from HTML. A security flaw allows an attacker to execute malicious code on the server if they can control the output filename and upload a specially crafted file. This could lead to a full system compromise, though it primarily affects older environments running PHP versions earlier than 8.0.

Technologies: pontedilana/php-weasyprint (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-49286 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49286 being exploited in the wild.
How severe is CVE-2026-49286?
High severity, with a CVSS score of 8.1, published 19 June 2026.
Which products and versions are affected?
pontedilana/php-weasyprint (Packagist) <= 2.5.1, ECOSYSTEM:introduced=0,fixed=2.6.0.
Is there a fix for CVE-2026-49286?
Yes. pontedilana/php-weasyprint (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49286 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49286?
Check whether you run pontedilana/php-weasyprint (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pontedilana/php-weasyprint (Packagist): upgrade to 2.6.0 or later
    composer require pontedilana/php-weasyprint:^2.6.0

Technical details

PhpWeasyPrint versions up to 2.5.1 are vulnerable to PHAR deserialization, a bypass of the previous fix for CVE-2023-28115. The library attempted to block the 'phar://' stream wrapper using a case-sensitive check with strpos(). Because PHP stream wrappers are case-insensitive, an attacker can bypass this check using variations like 'PHAR://'. When the library calls file_exists() on such a path in AbstractGenerator::prepareOutput(), it triggers the deserialization of PHAR metadata. If the application is running on PHP < 8.0 and suitable gadget chains are present in the project's dependencies, an attacker can achieve remote code execution. This requires the attacker to be able to influence the output filename and have a method to place a malicious PHAR file on the local filesystem. The issue is fixed in version 2.6.0 by implementing a protocol allow-list.

Affected products

  • pontedilana php-weasyprint <= 2.5.1

Identifiers

  • CVE-2026-49286
  • GHSA-2fmj-p74r-3wjm

Timeline

  • 2026-05-25: disclosed: Advisory published by endelwar
  • 2026-06-19: advisory: NVD published CVE-2026-49286
  • 2026-06-26: advisory: GitHub Advisory Database entry updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.