CVE-2026-49260

Name of the Vulnerable Software and Affected Versions PhpWeasyPrint versions prior to 2.5.1

Description PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The software contains a shell command injection flaw occurring when the binary path for WeasyPrint is processed. The library passes the binary path through escapeshellarg() and then validates the quoted result using is executable(). On POSIX systems, this results in is executable() searching for a filename that literally includes the quotes, causing the security check to fail. Consequently, the raw $binary string, which can be set via the constructor or the setBinary() function, is passed directly into SymfonyComponentProcessProcess::fromShellCommandline(). This creates a risk of command injection if the binary path is sourced from environment variables, configuration files, or per-tenant settings.

Recommendations Update to version 2.5.1.