Executive brief
PhpWeasyPrint, a library used to generate PDF documents, contains a vulnerability that allows attackers to force the server to download files or access internal network resources. By providing a specially crafted URL as a PDF attachment, an attacker can trick the system into including sensitive local files or internal data directly inside the generated PDF. This could lead to the exposure of private configuration files, credentials, or internal service data.
Technical details
The vulnerability exists in the `isOptionUrl()` and `handleArrayOptions()` methods within `src/Pdf.php`. The library uses `filter_var()` with `FILTER_VALIDATE_URL` to determine if an attachment value is a URL, and if so, fetches its content using `file_get_contents()`. Because the library does not restrict the URL schemes, an attacker can use `file://`, `ftp://`, or PHP stream wrappers like `php://filter/` to exfiltrate local files or perform SSRF against internal endpoints. The fetched content is then embedded as an attachment in the resulting PDF. This issue is patched in version 2.6.0 by implementing a scheme allow-list (defaulting to http/https).
Affected products
- pontedilana php-weasyprint <= 2.5.1
Timeline
- 2026-05-25: disclosed: Advisory published by maintainer
- 2026-06-19: advisory: NVD published CVE-2026-49359
- 2026-06-26: patched: GitHub Advisory reviewed and updated with patch information
References
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56
- https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36
- https://github.com/pontedilana/php-weasyprint/commit/9582dcf119a405276cf55e9e10bc577a887792cb
- https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0
- https://api.github.com/repos/pontedilana/php-weasyprint/security-advisories/GHSA-x8g9-h984-pc36