---
id: CVE-2026-49358
title: >-
  PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public
  $temporaryFiles
summary: >-
  PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public
  $temporaryFiles
severity: low
cvss: 3
cwe:
  - CWE-73
vendor: pontedilana
product: pontedilana/php-weasyprint
ecosystem: composer
affected:
  - pontedilana/php-weasyprint <= 2.5.1
patched:
  - pontedilana/php-weasyprint 2.6.0
published: '2026-06-26'
updated: '2026-06-26'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-5g9f-cwwg-4p8g'
references:
  - url: 'https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4'
  - url: >-
      https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49358'
  - url: >-
      https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391
  - url: 'https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0'
  - url: 'https://github.com/advisories/GHSA-5g9f-cwwg-4p8g'
tags:
  - ghsa
  - composer
epss: 0.00149
epssPercentile: 0.03419
ingestedAt: '2026-06-29T13:24:35.102Z'
---

## Overview

### Summary

`AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.

This mirrors the KnpLabs/snappy issue [GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4), patched in snappy 1.7.2.

### Affected versions

`pontedilana/php-weasyprint` versions `<= 2.5.1`.

Patched in: `2.6.0`.

### Vulnerable code

`src/AbstractGenerator.php`:

```php
public array $temporaryFiles = [];

// ...

public function removeTemporaryFiles(): void
{
    foreach ($this->temporaryFiles as $file) {
        $this->unlink($file);
    }
}
```

No path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked.

### Proof of concept

```php
<?php
use Pontedilana\PhpWeasyPrint\Pdf;

$pdf = new Pdf();
$pdf->temporaryFiles[] = '/var/www/html/.env';

// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.
```

### Impact

- Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.
- Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is **amplification**: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.

CWE-73 (External Control of File Name or Path).

### Suggested fix

Only delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths:

```php
public function removeTemporaryFiles(): void
{
    $temporaryFolderPath = \realpath($this->getTemporaryFolder());
    if (false === $temporaryFolderPath) {
        return;
    }
    $temporaryFolderPath = \rtrim($temporaryFolderPath, \DIRECTORY_SEPARATOR) . \DIRECTORY_SEPARATOR;

    foreach ($this->temporaryFiles as $file) {
        $filePath = \realpath($file);
        if (false === $filePath || 0 !== \strncmp($filePath, $temporaryFolderPath, \strlen($temporaryFolderPath))) {
            continue;
        }
        $this->unlink($file);
    }
}
```

(The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.)

### Credit

Reported upstream to KnpLabs/snappy ([GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4)); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.

## Affected packages

- `pontedilana/php-weasyprint <= 2.5.1`

## Remediation

Upgrade to a patched release:

- `pontedilana/php-weasyprint 2.6.0`