Executive brief
PhpWeasyPrint is a library used to generate PDF documents from web pages. A security flaw allows an attacker who can already influence the application's internal state to delete arbitrary files on the server when the script finishes running. This could be used to delete critical configuration files or cover the tracks of other malicious activity.
Technical details
The vulnerability exists in `AbstractGenerator.php` where the `$temporaryFiles` property is declared as a public array. The `removeTemporaryFiles()` method, which is triggered during object destruction or script shutdown, iterates through this array and calls `unlink()` on each entry without verifying that the files reside within the designated temporary directory. An attacker who can manipulate this public property—for example, through a separate deserialization vulnerability or a property-oriented programming (POP) chain—can specify arbitrary file paths to be deleted. The issue is fixed in version 2.6.0 by implementing canonical path checks using `realpath()` to ensure only files within the temporary folder are deleted.
Affected products
- pontedilana php-weasyprint <= 2.5.1
Timeline
- 2026-05-25: disclosed: Advisory published by endelwar
- 2026-06-19: advisory: NVD published CVE-2026-49358
- 2026-06-26: advisory: GitHub reviewed advisory published
References
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4
- https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g
- https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391
- https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0
- https://api.github.com/repos/pontedilana/php-weasyprint/security-advisories/GHSA-5g9f-cwwg-4p8g