{"id":"CVE-2026-49286","published":"2026-06-19T17:03:58Z","modified":"2026-06-22T14:23:32Z","title":"PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)","vendor":"pontedilana","product":"php-weasyprint","tier":"tail","description":{"text":"PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00735,"percentile":0.54281,"provenance":"source"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-2fmj-p74r-3wjm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj","tags":["x_refsource_MISC"]},{"url":"https://github.com/pontedilana/php-weasyprint/commit/d1aa487722b5a3cab9b222b85fdb5608a5a550c3","tags":["x_refsource_MISC"]},{"url":"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0","tags":["x_refsource_MISC"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":10.86},{"name":"CVSS severity","points":5.67}]},"vendorSlug":"pontedilana","affectedVersions":[{"vendor":"pontedilana","product":"php-weasyprint","versions":["< 2.6.0"]}],"affected":[{"ecosystem":"Packagist","package":"pontedilana/php-weasyprint","vulnerableRanges":["<2.6.0"],"patched":["2.6.0"],"from":["GHSA-2fmj-p74r-3wjm"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-38053","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-knplabs-snappy-cve-2023-28115","parents":[{"from":"CVE-2023-28115","to":"CVE-2026-49286","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This is the patch-bypass of CVE-2023-28115.","from":"CVE.org","in":"CVE-2026-49286"}]},{"from":"CVE-2023-41330","to":"CVE-2026-49286","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-92rv-4j2h-8mjj","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-2fmj-p74r-3wjm","via":"reference","url":"https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj"}]}],"packageHistory":[{"cve":"CVE-2026-49260","published":"2026-06-19","fixed":"2.5.1","kev":false,"link":{"from":"CVE-2026-49260","to":"CVE-2026-49286","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pontedilana/php-weasyprint","fromFixed":"2.5.1","toFixed":"2.6.0","daysApart":0},{"kind":"similar","provenance":"machine","score":0.33,"basis":"same product + description similarity"}]}},{"cve":"CVE-2026-49286","published":"2026-06-19","fixed":"2.6.0","kev":false},{"cve":"CVE-2026-49358","published":"2026-06-19","fixed":"2.6.0","kev":false},{"cve":"CVE-2026-49359","published":"2026-06-19","fixed":"2.6.0","kev":false}],"package":"Packagist:pontedilana/php-weasyprint"}}