CVE-2026-49286: PhpWeasyPrint RCE via Case-Insensitive PHAR Bypass

Technical summary

CVE-2026-49286 is a remote code execution vulnerability stemming from incomplete mitigation of CVE-2023-28115 in PhpWeasyPrint. The underlying issue involves case-sensitive blacklisting of the `phar://` stream wrapper in the output filename validation within `prepareOutput()`. Because PHP stream wrappers are case-insensitive, attackers can bypass the filter using uppercase or mixed-case variants (e.g., `PHAR://`, `Phar://`). On PHP 7.4+ environments, the bypassed `file_exists()` call triggers automatic deserialization of malicious PHAR metadata, resulting in arbitrary code execution. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The same class of vulnerability was patched upstream in the related KnpLabs/snappy library (GHSA-92rv-4j2h-8mjj). Version 2.6.0 implements a case-insensitive filter to prevent bypass.

Business impact

Organizations using vulnerable versions of PhpWeasyPrint in production environments face direct risk of unauthorized code execution within their application context. An attacker exploiting this flaw can read sensitive data, modify application behavior, pivot to internal systems, or establish persistence. The impact depends on the privilege level and network position of the affected application; web-facing PDF generation services are particularly exposed. Incident response costs, data breach notification obligations, and service downtime can result. The 8.1 CVSS score reflects the high severity: network-accessible, no user interaction required, and full system compromise possible.

Affected systems

The vulnerability affects `pontedilana/php-weasyprint` prior to version 2.6.0. It is triggered only on PHP 7.4+ environments where object deserialization occurs during PHAR metadata processing. Applications using earlier versions of the library to generate PDFs from user-controlled or semi-trusted input are at risk. Composer-managed PHP projects and custom installations are equally affected. The vulnerability does not affect PhpWeasyPrint 2.6.0 and later, where the case-insensitive filter is in place.

Exploitability

Exploitation requires an attacker to supply a malicious PHAR archive or influence the input to the PDF generation function. The attack vector is network-based with no authentication or user interaction needed, though the attacker must craft the payload and deliver it to a vulnerable endpoint. The 'High' attack complexity (AC:H) in the CVSS vector suggests that specific conditions or timing may be needed, such as knowledge of the application's input handling or file path construction. Proof-of-concept code exists upstream in the snappy project, making weaponization straightforward for threat actors. The fact that this is a patch-bypass of a previously disclosed vulnerability increases the likelihood that malicious actors are actively testing for incomplete patches.

Remediation

The definitive remediation is to upgrade PhpWeasyPrint to version 2.6.0 or later. This release implements case-insensitive filtering of prohibited stream wrappers, eliminating the bypass vector. Organizations should verify compatibility with their current PHP version (7.4 minimum) and run regression tests on PDF generation workflows. As an interim measure, if upgrading is delayed, restricting the sources of input to PDF generation (e.g., whitelisting trusted templates, disallowing user-supplied URLs) reduces exposure. Disabling PHP's phar stream wrapper at the php.ini level (`allow_url_fopen = off`, though this may have broader effects) is a defense-in-depth option.

Patch guidance

Apply version 2.6.0 of `pontedilana/php-weasyprint` or verify that the installed version includes the case-insensitive stream wrapper filter. If using Composer, update with `composer update pontedilana/php-weasyprint` and confirm the version constraint resolves to 2.6.0+. Review release notes to confirm the patch addresses CVE-2026-49286 specifically, as this is a patch-bypass scenario. Test in a staging environment before production deployment to ensure PDF generation continues to function as expected. Monitor for additional updates if this vulnerability class persists in the dependency chain.

Detection guidance

Monitor application logs for suspicious file access attempts using `phar://` or case-variant stream wrappers in PDF generation requests. Web application firewalls (WAF) can flag requests containing `PHAR://`, `Phar://`, or similar patterns in URL or file path parameters. Endpoint detection and response (EDR) solutions should alert on unexpected code execution or process spawning from PHP-FPM or Apache processes handling PDF requests. Version scanning of dependencies (e.g., via `composer show` or SBOM analysis) will identify outdated PhpWeasyPrint installations. Check application-level logging for `file_exists()` errors or exception traces mentioning PHAR deserialization.

Why prioritize this

This vulnerability should be prioritized immediately because it is a known patch-bypass of a previously disclosed flaw, indicating that threat actors are actively testing for incomplete patches. The CVSS 8.1 score, combined with network accessibility and no authentication requirement, makes this a high-risk issue. Any web-facing PDF generation service using vulnerable versions should be treated as potentially compromised until patched and audited. The fact that proof-of-concept techniques exist in upstream projects accelerates the timeline to active exploitation.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network-accessible attack vector with no authentication; (2) High attack complexity due to payload crafting requirements; (3) No user interaction needed; (4) High impact on confidentiality, integrity, and availability through arbitrary code execution. The severity is tempered slightly by the complexity of crafting a malicious PHAR archive, but this is offset by the widespread availability of proof-of-concept code and the prevalence of PHP PDF generation in web applications. In context of this being a patch-bypass, the practical risk is elevated relative to the CVSS score alone.

Frequently asked questions