{"id":"CVE-2026-49358","aliases":["GHSA-5g9f-cwwg-4p8g"],"url":"https://o3.security/vulnerability/CVE-2026-49358","summary":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","details":"### Summary\n\n`AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.\n\nThis mirrors the KnpLabs/snappy issue [GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4), patched in snappy 1.7.2.\n\n### Affected versions\n\n`pontedilana/php-weasyprint` versions `<= 2.5.1`.\n\nPatched in: `2.6.0`.\n\n### Vulnerable code\n\n`src/AbstractGenerator.php`:\n\n```php\npublic array $temporaryFiles = [];\n\n// ...\n\npublic function removeTemporaryFiles(): void\n{\n    foreach ($this->temporaryFiles as $file) {\n        $this->unlink($file);\n    }\n}\n```\n\nNo path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked.\n\n### Proof of concept\n\n```php\n<?php\nuse Pontedilana\\PhpWeasyPrint\\Pdf;\n\n$pdf = new Pdf();\n$pdf->temporaryFiles[] = '/var/www/html/.env';\n\n// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.\n```\n\n### Impact\n\n- Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.\n- Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is **amplification**: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.\n\nCWE-73 (External Control of File Name or Path).\n\n### Suggested fix\n\nOnly delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths:\n\n```php\npublic function removeTemporaryFiles(): void\n{\n    $temporaryFolderPath = \\realpath($this->getTemporaryFolder());\n    if (false === $temporaryFolderPath) {\n        return;\n    }\n    $temporaryFolderPath = \\rtrim($temporaryFolderPath, \\DIRECTORY_SEPARATOR) . \\DIRECTORY_SEPARATOR;\n\n    foreach ($this->temporaryFiles as $file) {\n        $filePath = \\realpath($file);\n        if (false === $filePath || 0 !== \\strncmp($filePath, $temporaryFolderPath, \\strlen($temporaryFolderPath))) {\n            continue;\n        }\n        $this->unlink($file);\n    }\n}\n```\n\n(The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.)\n\n### Credit\n\nReported upstream to KnpLabs/snappy ([GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4)); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.","published":"2026-06-19T14:52:05.368Z","modified":"2026-08-12T03:51:10.303315629Z","cvss":{"score":3,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L"},"epss":{"score":0.00149,"percentile":0.04499,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"pontedilana/php-weasyprint","fixedVersion":"2.6.0"}],"fix":{"url":"https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391","label":"pontedilana/php-weasyprint@6d328ff"},"references":[{"type":"WEB","url":"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49358.json"},{"type":"ADVISORY","url":"https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4"},{"type":"ADVISORY","url":"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49358"},{"type":"FIX","url":"https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391"},{"type":"PACKAGE","url":"https://github.com/pontedilana/php-weasyprint"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:10.303315629Z"}}