CVE-2026-49358

LowCVSS 3.0/10Last modified Jun 23, 2026

Description

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4. PhpWeasyPrint version 2.6.0 contains a patch for the issue.

Metrics

CVSS 3.1 3.0/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: Jun 19, 2026
Last modified: Jun 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-493596.5PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetc CVE-2026-49366.2IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 throug CVE-2026-493607.8Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.50.0, OSS server deployments that expose CVE-2026-493617.5Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, al CVE-2026-493627.5An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulat CVE-2026-493637.5An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY reque CVE-2026-493649.1An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster CVE-2026-493655.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP CVE-2026-493667.8In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion CVE-2026-493678.8In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account CVE-2026-493685.4In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible CVE-2026-493694.3In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages