PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49359 pontedilana CVE debrief

CVE-2026-49359 is a Server-Side Request Forgery (SSRF) vulnerability in the PhpWeasyPrint library, which allows attackers to fetch server-side content via `file_get_contents()` when the value resembles a URL. This issue, patched in version 2.6.0, enables attackers to exfiltrate data as a PDF attachment. Affected systems should prioritize upgrading to version 2.6.0 or later. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity.

Vendor
pontedilana
Product
php-weasyprint
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-19
Original CVE updated
2026-06-23
Advisory published
2026-06-19
Advisory updated
2026-06-23

Who should care

Developers and administrators using PhpWeasyPrint library versions prior to 2.6.0 should be concerned, as an attacker could exploit this vulnerability to access internal HTTP endpoints, cloud metadata, or local files, leading to potential data exfiltration.

Technical summary

The PhpWeasyPrint library, used for generating PDFs from URLs or HTML pages, is vulnerable to Server-Side Request Forgery (SSRF) and local file disclosure. The `attachment` option of the `Pdf` class is a reachable sink, allowing any value that passes `isOptionUrl()` to be downloaded and embedded into the generated PDF. This issue arises because `FILTER_VALIDATE_URL` accepts various URL schemes, including `http`, `https`, `ftp`, `file`, and PHP stream wrappers like `php://`. An attacker can influence the `attachment` value to access internal resources or local files, with the fetched bytes exfiltrated as a PDF attachment.

Defensive priority

Upgrade to PhpWeasyPrint version 2.6.0 or later to patch the vulnerability. Implement input validation and sanitization for the `attachment` option to restrict URL schemes. Monitor for suspicious PDF generation activity.

Recommended defensive actions

  • Upgrade to PhpWeasyPrint version 2.6.0 or later
  • Implement input validation and sanitization for the `attachment` option
  • Monitor for suspicious PDF generation activity
  • Review and restrict URL schemes allowed by `FILTER_VALIDATE_URL`
  • Conduct regular security audits and vulnerability assessments

Evidence notes

The CVE-2026-49359 vulnerability is documented in the official CVE record (cve.org) and NVD detail (nvd.nist.gov). The PhpWeasyPrint library's GitHub repository provides additional information on the patch (github.com/pontedilana/php-weasyprint).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49359 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49359

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49359 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49359

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.