PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46643 KnpLabs CVE debrief

CVE-2026-46643 is a vulnerability in the Snappy PHP library, which is used for thumbnail, snapshot, or PDF generation from a URL or HTML page. The vulnerability occurs on POSIX systems where the `escapeshellarg` function returns a literal string with single-quote characters included, which are not properly handled by the `is_executable` function. This allows for command injection when the binary path is sourced from user-influenced configuration, environment variables, or concatenated with user-controlled fragments. The vulnerability has been patched in version 1.7.1 of the Snappy library.

Vendor
KnpLabs
Product
snappy
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Users of the Snappy PHP library, especially those who generate thumbnails, snapshots, or PDFs from user-provided URLs or HTML pages, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability occurs due to improper handling of the binary path in the Snappy library. Specifically, the `escapeshellarg` function returns a literal string with single-quote characters included, which are not properly handled by the `is_executable` function. This allows for command injection when the binary path is sourced from user-influenced configuration, environment variables, or concatenated with user-controlled fragments.

Defensive priority

HIGH

Recommended defensive actions

  • Update the Snappy library to version 1.7.1 or later.
  • Review and validate the binary path configuration to ensure it is not user-influenced.
  • Use secure environment variables and avoid concatenating user-controlled fragments with the binary path.

Evidence notes

The vulnerability has been patched in version 1.7.1 of the Snappy library. Users can refer to the [patch release](ref-4) and [security advisory](ref-5) for more information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46643 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46643

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46643 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46643

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.