PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49358 pontedilana CVE debrief

CVE-2026-49358 is a vulnerability in PhpWeasyPrint, a PHP library for generating PDFs from URLs or HTML pages. The issue allows for arbitrary file deletion due to insecure handling of temporary files. Specifically, the public array `AbstractGenerator::$temporaryFiles` can be manipulated to delete arbitrary files when `removeTemporaryFiles()` is called. This vulnerability has a CVSS score of 3 and is considered low severity. PhpWeasyPrint version 2.6.0 patches this issue. Defenders should prioritize updating to the patched version to limit exposure.

Vendor
pontedilana
Product
php-weasyprint
CVSS
LOW 3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-19
Original CVE updated
2026-06-23
Advisory published
2026-06-19
Advisory updated
2026-06-23

Who should care

Developers and administrators using PhpWeasyPrint, especially those generating PDFs from untrusted sources, should be aware of this vulnerability. The ability to delete arbitrary files could lead to data loss or system compromise. Reviewing and updating PhpWeasyPrint to version 2.6.0 or later is recommended.

Technical summary

The vulnerability in PhpWeasyPrint arises from the public `AbstractGenerator::$temporaryFiles` array, which can be manipulated to delete arbitrary files. The `removeTemporaryFiles()` method, called during script shutdown, unlinks files in this array without path validation. This could allow an attacker to delete files anywhere on the system where the PHP script has write permissions. The vulnerability is patched in PhpWeasyPrint version 2.6.0.

Defensive priority

Low severity, but high priority for systems using PhpWeasyPrint with untrusted input due to potential for data loss.

Recommended defensive actions

  • Update PhpWeasyPrint to version 2.6.0 or later
  • Review and validate temporary file handling in existing code
  • Implement compensating controls to restrict file deletion
  • Monitor for suspicious file deletion activity
  • Inventory systems using PhpWeasyPrint for immediate patching

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. The PhpWeasyPrint GitHub repository contains the patched version (2.6.0) and additional details. The vulnerability is similar to GHSA-87qc-37cw-84h4 in KnpLabs/snappy.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49358 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49358

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49358 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49358

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.