Shell Command Injection in PhpWeasyPrint by Vendor Pontedilana

CVE-2026-49260

What is CVE-2026-49260?

The PhpWeasyPrint library, utilized for generating PDFs from URLs or HTML pages, has a vulnerability stemming from improper handling of shell commands. Specifically, prior to version 2.5.1, the library incorrectly checks whether the WeasyPrint binary can be executed. Due to the way escapeshellarg() interacts with POSIX environments, it can lead to a situation where the is_executable() method checks for a nonexistent executable file. This flaw enables an attacker to exploit the raw binary path, especially when it is sourced from configuration files or environment variables. This oversight could lead to unauthorized command execution, highlighting the importance of upgrading to version 2.5.1, which rectifies this issue.

References