{"id":"CVE-2026-49358","aliases":["EUVD-2026-38036","GHSA-5g9f-cwwg-4p8g"],"status":"published","title":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","description":"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.","severity":{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00166,"percentile":0.05823,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-73"],"published":"2026-06-19T14:52:05Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Packagist","package":"pontedilana/php-weasyprint","fixed_in":["2.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pontedilana/php-weasyprint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.1"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pontedilana/php-weasyprint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.12.0","0.13.0","0.9.0","1.0.0","1.0.1","1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.5.0","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.5.0","2.5.1"]}],"products":[{"vendor":"pontedilana","product":"php-weasyprint"}],"references":[{"url":"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4","tags":["x_refsource_MISC","advisory","web"]},{"url":"https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49358","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5g9f-cwwg-4p8g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49358.json","tags":["advisory"]},{"url":"https://github.com/pontedilana/php-weasyprint","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-49358","title":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","description":"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.","status":"published","published":"2026-06-19T14:52:05.368Z","modified":"2026-06-23T02:09:16.687Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-38036","description":"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.","status":"published","published":"2026-06-19T14:52:05Z","modified":"2026-06-23T02:09:16Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T18:20:33.850201Z"}],"ghsa":[{"id":"GHSA-5g9f-cwwg-4p8g","title":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","description":"### Summary\n\n`AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.\n\nThis mirrors the KnpLabs/snappy issue [GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4), patched in snappy 1.7.2.\n\n### Affected versions\n\n`pontedilana/php-weasyprint` versions `\u003c= 2.5.1`.\n\nPatched in: `2.6.0`.\n\n### Vulnerable code\n\n`src/AbstractGenerator.php`:\n\n```php\npublic array $temporaryFiles = [];\n\n// ...\n\npublic function removeTemporaryFiles(): void\n{\n    foreach ($this-\u003etemporaryFiles as $file) {\n        $this-\u003eunlink($file);\n    }\n}\n```\n\nNo path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked.\n\n### Proof of concept\n\n```php\n\u003c?php\nuse Pontedilana\\PhpWeasyPrint\\Pdf;\n\n$pdf = new Pdf();\n$pdf-\u003etemporaryFiles[] = '/var/www/html/.env';\n\n// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.\n```\n\n### Impact\n\n- Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.\n- Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is **amplification**: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.\n\nCWE-73 (External Control of File Name or Path).\n\n### Suggested fix\n\nOnly delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths:\n\n```php\npublic function removeTemporaryFiles(): void\n{\n    $temporaryFolderPath = \\realpath($this-\u003egetTemporaryFolder());\n    if (false === $temporaryFolderPath) {\n        return;\n    }\n    $temporaryFolderPath = \\rtrim($temporaryFolderPath, \\DIRECTORY_SEPARATOR) . \\DIRECTORY_SEPARATOR;\n\n    foreach ($this-\u003etemporaryFiles as $file) {\n        $filePath = \\realpath($file);\n        if (false === $filePath || 0 !== \\strncmp($filePath, $temporaryFolderPath, \\strlen($temporaryFolderPath))) {\n            continue;\n        }\n        $this-\u003eunlink($file);\n    }\n}\n```\n\n(The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.)\n\n### Credit\n\nReported upstream to KnpLabs/snappy ([GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4)); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.","status":"published","published":"2026-06-26T22:10:51Z","modified":"2026-06-26T22:10:53Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:40:34.713036Z"}],"nvd":[{"id":"CVE-2026-49358","description":"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.","status":"published","published":"2026-06-19T15:16:35.143Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-49358","title":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","description":"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.","status":"published","published":"2026-06-19T14:52:05.368Z","modified":"2026-10-28T02:30:56.338670411Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"GHSA-5g9f-cwwg-4p8g","title":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","description":"### Summary\n\n`AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.\n\nThis mirrors the KnpLabs/snappy issue [GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4), patched in snappy 1.7.2.\n\n### Affected versions\n\n`pontedilana/php-weasyprint` versions `\u003c= 2.5.1`.\n\nPatched in: `2.6.0`.\n\n### Vulnerable code\n\n`src/AbstractGenerator.php`:\n\n```php\npublic array $temporaryFiles = [];\n\n// ...\n\npublic function removeTemporaryFiles(): void\n{\n    foreach ($this-\u003etemporaryFiles as $file) {\n        $this-\u003eunlink($file);\n    }\n}\n```\n\nNo path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked.\n\n### Proof of concept\n\n```php\n\u003c?php\nuse Pontedilana\\PhpWeasyPrint\\Pdf;\n\n$pdf = new Pdf();\n$pdf-\u003etemporaryFiles[] = '/var/www/html/.env';\n\n// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.\n```\n\n### Impact\n\n- Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.\n- Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is **amplification**: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.\n\nCWE-73 (External Control of File Name or Path).\n\n### Suggested fix\n\nOnly delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths:\n\n```php\npublic function removeTemporaryFiles(): void\n{\n    $temporaryFolderPath = \\realpath($this-\u003egetTemporaryFolder());\n    if (false === $temporaryFolderPath) {\n        return;\n    }\n    $temporaryFolderPath = \\rtrim($temporaryFolderPath, \\DIRECTORY_SEPARATOR) . \\DIRECTORY_SEPARATOR;\n\n    foreach ($this-\u003etemporaryFiles as $file) {\n        $filePath = \\realpath($file);\n        if (false === $filePath || 0 !== \\strncmp($filePath, $temporaryFolderPath, \\strlen($temporaryFolderPath))) {\n            continue;\n        }\n        $this-\u003eunlink($file);\n    }\n}\n```\n\n(The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.)\n\n### Credit\n\nReported upstream to KnpLabs/snappy ([GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4)); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.","status":"published","published":"2026-06-26T22:10:51Z","modified":"2026-09-10T03:50:48.319605683Z","cvss":[{"version":"3.1","score":3,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}