pontedilana/php-weasyprint Security Advisories | GitStock

medium2026-06-26

PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

GHSA-x8g9-h984-pc36 · CVE-2026-49359

low2026-06-26

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

GHSA-5g9f-cwwg-4p8g · CVE-2026-49358

high2026-06-26

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

GHSA-2fmj-p74r-3wjm · CVE-2026-49286

high2026-06-26

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

GHSA-f5gc-qxf8-mh9g · CVE-2026-49260