PHP Library Flaw Leads to Remote Code Execution in Pdf Generation Tool by Pontedilana

CVE-2026-49286

What is CVE-2026-49286?

The PhpWeasyPrint library, a PHP solution for generating PDFs from URLs or HTML pages, exhibits a security vulnerability prior to version 2.6.0. The issue arises from the library's inadequate guarding of the output filename against the case-insensitive nature of the phar:// PHP stream wrapper. Attackers can exploit this flaw using various case variations of the PHAR scheme, potentially triggering the fileExists() function. This can lead to deserialization of malicious PHAR archive metadata when used with PHP version 7.4 or higher, resulting in remote code execution. A patch addressing this issue has been implemented in version 2.6.0 of PhpWeasyPrint.

References