CVE-2026-49286

Name of the Vulnerable Software and Affected Versions PhpWeasyPrint versions prior to 2.6.0

Description PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The software uses a case-sensitive blacklist to protect output filenames against the phar:// stream wrapper. Because PHP stream wrappers are case-insensitive, using variations such as PHAR:// or Phar:// bypasses this check and reaches the fileExists() (file exists()) function within prepareOutput(). On PHP 7 (specifically 7.4+), this allows the deserialization of crafted PHAR archive metadata, which can lead to remote code execution.

Recommendations Update to version 2.6.0.