CVE-2026-49358

Name of the Vulnerable Software and Affected Versions PhpWeasyPrint versions prior to 2.6.0

Description PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The AbstractGenerator::$temporaryFiles public array allows any code with a reference to a generator instance to insert arbitrary file paths. Because the removeTemporaryFiles() function, which is called by destruct() and a registered shutdown function, executes unlink() on all entries in this array without verifying if the paths are within the designated temporary folder, an attacker can cause the deletion of arbitrary files upon script shutdown.

Recommendations Update to version 2.6.0.