{"id":"CVE-2026-49358","title":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","summary":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","severity":"low","cvss":3,"cwe":["CWE-73"],"vendor":"pontedilana","product":"pontedilana/php-weasyprint","ecosystem":"composer","affected":["pontedilana/php-weasyprint <= 2.5.1"],"patched":["pontedilana/php-weasyprint 2.6.0"],"published":"2026-06-26","updated":"2026-06-26","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-5g9f-cwwg-4p8g","references":[{"url":"https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4"},{"url":"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49358"},{"url":"https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391"},{"url":"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"},{"url":"https://github.com/advisories/GHSA-5g9f-cwwg-4p8g"}],"tags":["ghsa","composer"],"epss":0.00149,"epssPercentile":0.045,"ingestedAt":"2026-06-29T13:24:35.102Z","slug":"CVE-2026-49358","body":"## Overview\n\n### Summary\n\n`AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.\n\nThis mirrors the KnpLabs/snappy issue [GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4), patched in snappy 1.7.2.\n\n### Affected versions\n\n`pontedilana/php-weasyprint` versions `<= 2.5.1`.\n\nPatched in: `2.6.0`.\n\n### Vulnerable code\n\n`src/AbstractGenerator.php`:\n\n```php\npublic array $temporaryFiles = [];\n\n// ...\n\npublic function removeTemporaryFiles(): void\n{\n    foreach ($this->temporaryFiles as $file) {\n        $this->unlink($file);\n    }\n}\n```\n\nNo path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked.\n\n### Proof of concept\n\n```php\n<?php\nuse Pontedilana\\PhpWeasyPrint\\Pdf;\n\n$pdf = new Pdf();\n$pdf->temporaryFiles[] = '/var/www/html/.env';\n\n// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.\n```\n\n### Impact\n\n- Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.\n- Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is **amplification**: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.\n\nCWE-73 (External Control of File Name or Path).\n\n### Suggested fix\n\nOnly delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths:\n\n```php\npublic function removeTemporaryFiles(): void\n{\n    $temporaryFolderPath = \\realpath($this->getTemporaryFolder());\n    if (false === $temporaryFolderPath) {\n        return;\n    }\n    $temporaryFolderPath = \\rtrim($temporaryFolderPath, \\DIRECTORY_SEPARATOR) . \\DIRECTORY_SEPARATOR;\n\n    foreach ($this->temporaryFiles as $file) {\n        $filePath = \\realpath($file);\n        if (false === $filePath || 0 !== \\strncmp($filePath, $temporaryFolderPath, \\strlen($temporaryFolderPath))) {\n            continue;\n        }\n        $this->unlink($file);\n    }\n}\n```\n\n(The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.)\n\n### Credit\n\nReported upstream to KnpLabs/snappy ([GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4)); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.\n\n## Affected packages\n\n- `pontedilana/php-weasyprint <= 2.5.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pontedilana/php-weasyprint 2.6.0`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":16.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}