CVE-2026-46683: Snappy : SSRF and local file read via the xsl-style-sheet option

(updated )

It impacts applications where:

  • the PHP daemon run with root permissions ;
  • the application is either running outside a container or has sensitive file access ;

It could happens with this kind of workflows:

$stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
$pdf->generate(‘page.html’, ‘out.pdf’, [
‘xsl-style-sheet’ => $stylesheet
]);

References

Code Behaviors & Features

Detect and mitigate CVE-2026-46683 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →