PatchSiren cyber security CVE debrief
CVE-2026-49359 pontedilana CVE debrief
CVE-2026-49359 is a Server-Side Request Forgery (SSRF) vulnerability in the PhpWeasyPrint library, which allows attackers to fetch server-side content via `file_get_contents()` when the value resembles a URL. This issue, patched in version 2.6.0, enables attackers to exfiltrate data as a PDF attachment. Affected systems should prioritize upgrading to version 2.6.0 or later. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity.
- Vendor
- pontedilana
- Product
- php-weasyprint
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-19
- Original CVE updated
- 2026-06-23
- Advisory published
- 2026-06-19
- Advisory updated
- 2026-06-23
Who should care
Developers and administrators using PhpWeasyPrint library versions prior to 2.6.0 should be concerned, as an attacker could exploit this vulnerability to access internal HTTP endpoints, cloud metadata, or local files, leading to potential data exfiltration.
Technical summary
The PhpWeasyPrint library, used for generating PDFs from URLs or HTML pages, is vulnerable to Server-Side Request Forgery (SSRF) and local file disclosure. The `attachment` option of the `Pdf` class is a reachable sink, allowing any value that passes `isOptionUrl()` to be downloaded and embedded into the generated PDF. This issue arises because `FILTER_VALIDATE_URL` accepts various URL schemes, including `http`, `https`, `ftp`, `file`, and PHP stream wrappers like `php://`. An attacker can influence the `attachment` value to access internal resources or local files, with the fetched bytes exfiltrated as a PDF attachment.
Defensive priority
Upgrade to PhpWeasyPrint version 2.6.0 or later to patch the vulnerability. Implement input validation and sanitization for the `attachment` option to restrict URL schemes. Monitor for suspicious PDF generation activity.
Recommended defensive actions
- Upgrade to PhpWeasyPrint version 2.6.0 or later
- Implement input validation and sanitization for the `attachment` option
- Monitor for suspicious PDF generation activity
- Review and restrict URL schemes allowed by `FILTER_VALIDATE_URL`
- Conduct regular security audits and vulnerability assessments
Evidence notes
The CVE-2026-49359 vulnerability is documented in the official CVE record (cve.org) and NVD detail (nvd.nist.gov). The PhpWeasyPrint library's GitHub repository provides additional information on the patch (github.com/pontedilana/php-weasyprint).
Official resources
This article is AI-assisted and based on the supplied source corpus.