Is CVE-2026-49358 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49358 being exploited in the wild.

How severe is CVE-2026-49358?

Low severity, with a CVSS score of 3.1, published 19 June 2026.

Which products and versions are affected?

pontedilana/php-weasyprint (Packagist) <= 2.5.1, ECOSYSTEM:introduced=0,fixed=2.6.0; Pontedilana Php-Weasyprint < 2.6.0.

Is there a fix for CVE-2026-49358?

Yes. pontedilana/php-weasyprint (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49358 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-49358?

Check whether you run pontedilana/php-weasyprint (Packagist) or Pontedilana Php-Weasyprint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49358: pontedilana PhpWeasyPrint arbitrary file deletion in AbstractGenerator

Q: Is there a fix for CVE-2026-49358?

Yes. pontedilana/php-weasyprint (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49358 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-49358?

Check whether you run pontedilana/php-weasyprint (Packagist) or Pontedilana Php-Weasyprint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49358 · Severity: low · CVSS 3.1 · Published 2026-06-19

PhpWeasyPrint is a library used to generate PDF documents from web pages. A security flaw allows an attacker who can already influence the application's internal state to delete arbitrary files on the server when the script finishes running. This could be used to delete critical configuration files or cover the tracks of other malicious activity.

Technologies: pontedilana/php-weasyprint (Packagist), Pontedilana Php-Weasyprint. Vendors: Packagist, Pontedilana.

Quick answers

Is CVE-2026-49358 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49358 being exploited in the wild.
How severe is CVE-2026-49358?: Low severity, with a CVSS score of 3.1, published 19 June 2026.
Which products and versions are affected?: pontedilana/php-weasyprint (Packagist) <= 2.5.1, ECOSYSTEM:introduced=0,fixed=2.6.0; Pontedilana Php-Weasyprint < 2.6.0.
Is there a fix for CVE-2026-49358?: Yes. pontedilana/php-weasyprint (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49358 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-49358?: Check whether you run pontedilana/php-weasyprint (Packagist) or Pontedilana Php-Weasyprint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pontedilana/php-weasyprint (Packagist): upgrade to 2.6.0 or later
```
composer require pontedilana/php-weasyprint:^2.6.0
```

Technical details

The vulnerability exists in `AbstractGenerator.php` where the `$temporaryFiles` property is declared as a public array. The `removeTemporaryFiles()` method, which is triggered during object destruction or script shutdown, iterates through this array and calls `unlink()` on each entry without verifying that the files reside within the designated temporary directory. An attacker who can manipulate this public property—for example, through a separate deserialization vulnerability or a property-oriented programming (POP) chain—can specify arbitrary file paths to be deleted. The issue is fixed in version 2.6.0 by implementing canonical path checks using `realpath()` to ensure only files within the temporary folder are deleted.

Affected products

pontedilana php-weasyprint <= 2.5.1

Identifiers

CVE-2026-49358
GHSA-5g9f-cwwg-4p8g

Timeline

2026-05-25: disclosed: Advisory published by endelwar
2026-06-19: advisory: NVD published CVE-2026-49358
2026-06-26: advisory: GitHub reviewed advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.