PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110646 beganovich CVE debrief

PatchSiren debrief for CVE-2026-110646: Beganovich snappdf versions 1.1.0 to 6.0.0 on Windows systems are vulnerable to OS command injection via the setUrl() function. This critical vulnerability allows attackers to execute arbitrary commands, posing a significant risk to defenders. The vulnerability is caused by the setUrl() function passing unescaped input to PHP's exec() function. Defenders responsible for Beganovich snappdf deployments on Windows systems should assess exposure and apply patches. Security teams should monitor systems for suspicious activity and review incident response plans. The CVE record and source item provide details on the OS command injection, allowing an

Vendor
beganovich
Product
snappdf
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for Beganovich snappdf deployments on Windows systems should assess exposure and apply patches. Security teams should monitor systems for suspicious activity and review incident response plans.

Why it matters

The OS command injection vulnerability in Beganovich snappdf versions 1.1.0 to 6.0.0 on Windows systems allows attackers to execute arbitrary commands, posing a critical risk to defenders.

  • Verify exposure of Beganovich snappdf versions 1.1.0 to 6.0.0 on Windows systems.
  • Apply patches for Beganovich snappdf version 6.1.0 or later.
  • Monitor systems for suspicious activity related to OS command injection.

Technical summary

The Beganovich snappdf library from version 1.1.0 to 6.0.0 contains an OS command injection vulnerability on Windows systems. The vulnerability is caused by the setUrl() function passing unescaped input to PHP's exec() function, allowing attackers to execute arbitrary commands. This critical vulnerability poses a significant risk to defenders, as attackers can influence the rendered URL to execute commands as the PHP process. The vulnerability affects Beganovich snappdf deployments on Windows systems, and defenders should prioritize verifying exposure and applying patches.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Beganovich snappdf versions 1.1.0 to 6.0.0, as an OS command injection vulnerability allows attackers to execute commands on Windows systems.

Recommended defensive actions

  • Verify exposure of Beganovich snappdf versions 1.1.0 to 6.0.0 on Windows systems.
  • Apply patches for Beganovich snappdf version 6.1.0 or later.
  • Monitor systems for suspicious activity related to OS command injection.
  • Review and update incident response plans to address potential exploitation.
  • Perform vulnerability scanning to identify exposed systems.
  • Implement compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions and retest remediated assets.

Evidence notes

The CVE record and source item provide details on the OS command injection vulnerability in Beganovich snappdf versions 1.1.0 to 6.0.0. The vulnerability allows attackers to execute commands on Windows systems by influencing the rendered URL.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110646 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110646

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110646 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110646

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110646.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/beganovich/snappdf/pull/54

    Supplemental source - patch, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/beganovich/snappdf/commit/5197bd3bcc4df44e17246dbceea9ce51eb390eae

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/beganovich/snappdf/blob/v6.0.0/src/Snappdf.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/beganovich/snappdf/releases/tag/v6.1.0

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/beganovich-snappdf-1.1.0-before-6.1.0-os-command-injection-on-windows-via-seturl

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.