CVE-2026-49358
CWE-73Published: June 19, 2026· Updated: Jun 23, 2026
Official Description
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.
Technical Analysis
CVE-2026-49358 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (5)
Quick Facts
Related CVEs (CWE-73)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-49358 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts