CVE-2026-49358: PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
AbstractGenerator::$temporaryFiles is a public array, and removeTemporaryFiles() — invoked from __destruct() and from a registered shutdown function — calls unlink() on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.
This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4, patched in snappy 1.7.2.
References
- github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4
- github.com/advisories/GHSA-5g9f-cwwg-4p8g
- github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391
- github.com/pontedilana/php-weasyprint/releases/tag/2.6.0
- github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g
- nvd.nist.gov/vuln/detail/CVE-2026-49358
Code Behaviors & Features
Detect and mitigate CVE-2026-49358 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →