PHP Library Vulnerability in PhpWeasyPrint Affects PDF Generation
CVE-2026-49358
3LOW
What is CVE-2026-49358?
The PhpWeasyPrint library, which facilitates PDF generation via URLs or HTML pages, contains an improper input validation issue up until version 2.6.0. The vulnerability stems from the public exposure of the AbstractGenerator::$temporaryFiles array and the method removeTemporaryFiles(), which lacks path verification before executing the unlink() command. This design flaw could allow an attacker to manipulate the array by inserting arbitrary paths, leading to the potential deletion of unintended files during script termination. The vulnerability has been addressed in version 2.6.0 with an appropriate patch.
Affected Version(s)
php-weasyprint < 2.6.0