CVE-2026-49286Disclosure

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud91d
General
🚨*CVE* CVE-2026-49286 PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename ag… https://www.cve.org/CVERecord?id=CVE-2026-49286 ----- Traducción: CVE-2026-49286 Php… http://infoflow.cloud`
Post summary
The entry cites CVE‑2026‑49286 for the PhpWeasyPrint PHP library, noting a pre‑2.6.0 version guard issue but provides no exploit, patch, or active exploitation details.
0000037
88 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-49286 PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename ag… https://www.cve.org/CVERecord?id=CVE-2026-49286
Post summary
Alert about CVE-2026-49286 in PhpWeasyPrint, noting that versions prior to 2.6.0 are affected and suggesting an upgrade as a remediation.
00000502
57.7K followersView on X

Explore more

Back to dashboard