CVE-2026-49358: PhpWeasyPrint Arbitrary File Deletion via Unsafe Temporary File Cleanup

Technical summary

The vulnerability stems from an insecure temporary file cleanup mechanism in PhpWeasyPrint versions prior to 2.6.0. The `AbstractGenerator::$temporaryFiles` array is declared as public, allowing any code with access to a generator instance to modify its contents. The `removeTemporaryFiles()` method, which executes both during object destruction (`__destruct()`) and via a registered PHP shutdown function, performs an `unlink()` operation on each array entry without path validation. Specifically, the code does not verify that paths are confined to the intended temporary directory before deletion. An attacker capable of maintaining a reference to an active generator instance can inject malicious file paths into the array, resulting in arbitrary file deletion when the script terminates. This design flaw mirrors a previously identified vulnerability in the KnpLabs/snappy project (GHSA-87qc-37cw-84h4) and represents improper resource disposal.

Business impact

The practical business impact is limited by the strict preconditions required for exploitation. An attacker must already have the ability to execute PHP code within the application's runtime context—a capability that typically indicates a prior compromise through another vector (e.g., code injection, deserialization flaw, or supply chain contamination). Given that requirement, the ability to delete files compounds the damage from that initial foothold. An attacker could delete application files, configuration files, or logs to cover tracks, escalate privilege within the application, or trigger a denial of service by removing critical system or application files. For organizations relying on PhpWeasyPrint for PDF generation in security-sensitive workflows, the risk is the secondary damage that follows successful initial compromise rather than an independent attack entry point.

Affected systems

PhpWeasyPrint versions prior to 2.6.0 are affected. The library is used in PHP applications that require server-side PDF generation capabilities. The vulnerability is present across all prior versions until the 2.6.0 release, which includes the security patch. No distinction is made between minor version numbers in the CVE record; all versions below 2.6.0 should be considered at risk.

Exploitability

Exploitation requires that an attacker already possess code execution capabilities within the PHP application—a significant barrier that limits this to post-compromise scenarios. The attack itself is straightforward once that access exists: an attacker maintaining a reference to the generator object can inject arbitrary file paths into the public `$temporaryFiles` array before the script exits. File deletion occurs automatically during shutdown without user interaction or additional prerequisites. The CVSS score of 3.0 (LOW severity) reflects this dependency on prior compromise; the vulnerability alone does not provide an attack entry point but rather extends the damage from an existing one. Practical exploitation would benefit from knowledge of the application's file structure and permissions, but blind attacks deleting common targets (e.g., `.htaccess`, configuration files) are feasible.

Remediation

Upgrade PhpWeasyPrint to version 2.6.0 or later. The patch restricts access to the temporary file list and adds path validation to the cleanup routine, ensuring that only files within the intended temporary directory are deleted. Organizations should verify the upgrade against the vendor advisory to confirm the specific patch applied. No workarounds exist within older versions; upgrading is the required remediation.

Patch guidance

Apply PhpWeasyPrint version 2.6.0 or newer as soon as practical. The patch is available from the official repository and package managers (e.g., Composer). Verify that your application's composer.json or equivalent dependency manifest is updated to require version 2.6.0 or a later stable release. Test the upgrade in a non-production environment to ensure compatibility with your specific use case before deploying to production. Given the LOW severity rating and the requirement for prior code execution, this can be scheduled with your regular patch cycle unless your environment has other known code execution risks that increase the urgency.

Detection guidance

Look for use of PhpWeasyPrint in your application inventory and check the installed version against 2.6.0 as a baseline. In a runtime detection sense, identify instances where external or untrusted input influences the creation of generator objects or could lead to references being shared across trust boundaries. Monitor for unexpected file deletion events in application logs or system audit trails, particularly deletions of application or configuration files during script shutdown. If you suspect exploitation, examine recent code commits or uploaded files for signs of compromise that preceded the file deletions. Endpoint or code analysis tools can flag public mutable attributes in dependency libraries as part of supply chain hygiene, though this is a preventive measure rather than post-exploit detection.

Why prioritize this

This vulnerability merits attention during regular patch cycles but does not demand emergency response. The LOW CVSS score (3.0) and the prerequisite of code execution already being present in the application mean that remediation should be balanced against other priorities. However, organizations with known code execution vulnerabilities in the same application or environment should prioritize this patch to limit the damage scope of those other flaws. Conversely, if your application is already running in a fully trusted environment with no prior code execution risks identified, the urgency is lower—though upgrading remains advisable as part of standard maintenance.

Risk score, explained

The CVSS 3.1 score of 3.0 (LOW) reflects the attack vector (Local), high attack complexity (code execution already required), high privileges (attacker must have prior compromise), and limited scope (same application context). The impact is rated as low integrity and low availability impact because while the attacker can delete files, the scope of deletable files is constrained by PHP process permissions and the attacker must already control code execution. The score acknowledges that this is a post-compromise amplification vector rather than a primary entry point, and that practical damage depends on file permissions, application architecture, and how critical the deleted files are to operations.

Frequently asked questions