Unsafe deserialization in knplabs/knp-snappy

CVE-2023-41330

What is CVE-2023-41330?

The KnpSnappy PHP library, which generates thumbnails, snapshots, or PDFs from URLs or HTML, is susceptible to a deserialization vulnerability. An attacker with control over the input parameter of the generateFromHtml() function can exploit this weakness, leading to remote code execution. The library previously included a safeguard against phar:// wrappers; however, the vulnerability can be bypassed using case sensitivity in PHP wrappers. The issue can be exploited only if an attacker can upload a malicious file and if the server is running a PHP version below 8. To mitigate the risk, users are strongly encouraged to upgrade to KnpSnappy version 1.4.3 or later.

References