CVE-2026-49359

Name of the Vulnerable Software and Affected Versions PhpWeasyPrint versions prior to 2.6.0

Description PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The library fetches content of option values server-side using the file get contents() function when a value is identified as a URL, but it fails to restrict the URL scheme. Specifically, the attachment option of Pdf serves as the sink; any value validated by isOptionUrl() is downloaded by the PHP process and embedded into the resulting PDF. Since the validation allows schemes such as http, https, ftp, file, and PHP stream wrappers like php://, an attacker capable of influencing the attachment value can achieve Server-Side Request Forgery (SSRF)—allowing access to internal HTTP endpoints or cloud metadata—and local file disclosure via file:// or php://filter/..., with the retrieved data exfiltrated as a PDF attachment.

Recommendations Update to version 2.6.0. As a temporary workaround, restrict or avoid using the attachment option in the Pdf class until the update is applied.