CVE-2026-49260: PhpWeasyPrint Shell Command Injection via Binary Path

Technical summary

The vulnerability is a shell command injection flaw in the PhpWeasyPrint library's binary path handling. The affected code uses `escapeshellarg()` to quote the WeasyPrint binary path, then calls `is_executable()` on the quoted string. Because `escapeshellarg()` adds single quotes to the path itself—for example, converting `/usr/local/bin/weasyprint` to the literal string `'/usr/local/bin/weasyprint'`—the `is_executable()` check looks for a file whose name includes quote characters. This file does not exist, so the safety branch never executes. The raw, unquoted binary path from the constructor or `setBinary()` method is passed directly to `Symfony\Component\Process\Process::fromShellCommandline()`, which interprets shell metacharacters. Any attacker who can control the binary path through configuration files, environment variables, or multi-tenant settings can inject shell commands that execute with the privileges of the PHP process.

Business impact

Organizations deploying PhpWeasyPrint in multi-tenant environments or configurations where the binary path is externally controlled face elevated risk. A compromised administrator account, misconfigured access controls, or a supply-chain compromise could allow attackers to execute arbitrary code on affected servers. This can lead to data theft, lateral movement within the network, service disruption, and compliance violations. The impact is amplified in SaaS platforms or shared hosting scenarios where a single server serves multiple customers. Immediate patching is strongly recommended for production systems, particularly those with user-controlled or dynamic binary path configurations.

Affected systems

Any deployment of PhpWeasyPrint prior to version 2.5.1 is vulnerable. The risk is highest in systems where the WeasyPrint binary path originates from configuration management, environment variables, or per-tenant settings rather than hardcoded values. This includes web applications, document generation services, report engines, and any system that dynamically configures the PDF generation backend. Organizations using alternative configurations or forks of the library should verify their specific versions against the upstream patch.

Exploitability

Exploitation requires an attacker with elevated privileges (High Privilege requirement per the CVSS vector), meaning they must already have significant access to the system—such as an administrator account, privileged process, or ability to modify configuration files and environment variables. However, the barrier to exploitation is low once this access is achieved; the attacker need only set the binary path to a malicious value such as `/bin/bash; touch /tmp/pwned; #` to execute arbitrary commands. No authentication bypass or user interaction is required. In multi-tenant or shared infrastructure scenarios, the privilege threshold may be lower than expected (e.g., a tenant admin modifying their own configuration).

Remediation

Upgrade PhpWeasyPrint to version 2.5.1 or later immediately. Version 2.5.1 corrects the binary path validation logic to properly verify that the (unquoted) path is executable before passing it to the shell command builder. Organizations should verify the patch version against official vendor releases and test in a staging environment before deploying to production. For systems that cannot be patched immediately, restrict write access to configuration files and environment variables that control the binary path to only highly trusted administrators, and audit access logs for unauthorized modifications.

Patch guidance

Update the `pontedilana/php-weasyprint` package to version 2.5.1 or later. If you manage dependencies via Composer, run `composer update pontedilana/php-weasyprint` to pull the patched version. Verify the update in your `composer.lock` file to confirm version 2.5.1 or higher is installed. Test PDF generation functionality in a non-production environment to ensure compatibility with your application before rolling out to production. If you maintain a private mirror or vendored copy of the library, apply the patch from the upstream repository and re-deploy. No configuration changes are required after upgrading; the fix is transparent to calling code.

Detection guidance

Monitor for suspicious modifications to configuration files that control the WeasyPrint binary path (e.g., `.env` files, YAML/JSON configuration, environment variable exports). Audit privileged account activity and configuration management tool logs for unexpected changes to the binary path setting. Inspect running PHP processes and their command-line arguments using `ps` or process monitoring tools for signs of shell metacharacters in the binary path. Review PHP error logs and application logs for unexpected system command output or errors originating from the PDF generation module. If you have comprehensive logging, search for any invocation of `setBinary()` or constructor calls with untrusted data. In multi-tenant environments, implement per-tenant audit trails and alert on modifications to shared infrastructure settings.

Why prioritize this

Although the CVSS score is 8.2 (HIGH) and the vulnerability requires High privilege to exploit, the combination of high impact (code execution with service privileges), relative ease of exploitation once privileged access is obtained, and the critical role PDF generation often plays in business workflows warrants immediate patching. The flaw is not a novel attack; it replicates a previously-patched vulnerability in a related library, indicating that defensive measures may already exist in some organizations but were not carried forward when this library was adopted. Prioritize environments that expose binary path configuration to multiple administrators or automated systems, or that serve multiple tenants.

Risk score, explained

The CVSS:3.1 score of 8.2 reflects a HIGH severity vulnerability with local attack vector, low attack complexity, high-privilege requirement, and scope change that enables impact to other systems. The score appropriately captures the severity of arbitrary code execution. However, the real-world risk depends heavily on your deployment model: hardcoded binary paths in code significantly lower risk, while dynamic configuration or multi-tenant scenarios elevate it. The vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog, but the architectural flaw is well-understood and easily exploitable once access is achieved.

Frequently asked questions