CVE-2026-49359: PhpWeasyPrint SSRF and File Disclosure via Unrestricted URL Schemes

Technical summary

CVE-2026-49359 is a Server-Side Request Forgery (SSRF) and local file disclosure vulnerability in pontedilana/php-weasyprint prior to version 2.6.0. The `Pdf` class's `attachment` option is vulnerable because it calls `file_get_contents()` on any value passing `isOptionUrl()` validation, which relies on PHP's `FILTER_VALIDATE_URL`. This filter permits `http`, `https`, `ftp`, `file`, and stream wrappers (`php://`, `phar://`, etc.). An authenticated attacker can supply a malicious URL to the attachment parameter, causing the PHP process to fetch and embed the resource contents into the generated PDF. This enables both SSRF attacks against internal services and file disclosure via `file://` or `php://filter/` wrappers. The vulnerability is classified as CWE-918 (Server-Side Request Forgery). The patch in version 2.6.0 restricts accepted URL schemes to safe protocols.

Business impact

Organizations using PhpWeasyPrint in customer-facing or multi-tenant applications face confidentiality breaches if an authenticated user can manipulate PDF generation parameters. Exposure scenarios include unauthorized access to application configuration files, database credentials stored locally, cloud provider metadata services (AWS, Azure, GCP), and internal API endpoints. In environments where the PHP process runs with elevated privileges or has access to sensitive infrastructure, the impact extends to lateral movement and privilege escalation within the network. The vulnerability requires prior authentication but no special privileges, making it a practical attack vector in applications with many users or liberal role assignments.

Affected systems

Any application using pontedilana/php-weasyprint versions prior to 2.6.0 is affected. The vulnerability is reachable if the application exposes PDF generation with user-controllable attachment parameters—either directly through public APIs, admin panels, or report features. Indirect exposure may occur if attachment values are sourced from databases populated by user input or external integrations without sanitization. Applications that do not use the attachment feature or do not expose it to user input are not vulnerable.

Exploitability

Exploitability is moderate. The attack requires an authenticated user or prior application access to influence the attachment parameter; there is no unauthenticated path to exploitation (CVSS PR:L reflects this). Once inside the application, however, exploitation is straightforward—no special client configuration or user interaction is needed. The attacker simply provides a crafted URL string. Detection by the target application's logging or IDS is plausible if the URL scheme or destination is anomalous, but standard logging often omits attachment parameters. No public exploit code or proof-of-concept has been disclosed as of the CVE publication date.

Remediation

Upgrade pontedilana/php-weasyprint to version 2.6.0 or later. Organizations unable to upgrade immediately should implement input validation at the application layer to restrict the attachment parameter to a whitelist of safe protocols (http, https only) and, where possible, validate against a whitelist of allowed hostnames or file paths. Consider disabling the attachment feature if it is not essential. Additionally, restrict the PHP process's network access and file system permissions using firewall rules, SELinux, or AppArmor to limit the blast radius of SSRF or file disclosure.

Patch guidance

Upgrade to pontedilana/php-weasyprint version 2.6.0 or later. Verify the upgrade through Composer: `composer show pontedilana/php-weasyprint` should report version 2.6.0 or higher. For teams on managed hosting or containerized deployments, update the dependency in composer.json to `"pontedilana/php-weasyprint": "^2.6.0"` and run `composer update`. Test PDF generation workflows post-upgrade to ensure the patched URL scheme restrictions do not break legitimate attachment use cases.

Detection guidance

Monitor application logs for PDF generation requests with suspicious attachment parameters, particularly those containing file://, php://, ftp://, or phar:// schemes. Correlate PDF generation timestamps with outbound network requests from the PHP process to internal or private IP ranges, cloud metadata endpoints (169.254.169.254, metadata.google.internal, etc.), or unexpected external destinations. Implement request/response logging at the application level to capture attachment parameters before they reach the vulnerable code path. Intrusion detection systems should flag HTTP requests from the web server process to internal services or metadata endpoints. Review git commit history and code reviews for uses of the attachment option to identify which applications are exposed.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), this vulnerability warrants near-term patching due to its high information disclosure impact and the ease of exploitation by authenticated users. It mirrors a previously patched vulnerability in KnpLabs/snappy (GHSA-c5fp-p67m-gq56), confirming it is a known attack pattern. Data exfiltration via cloud metadata or internal service responses can cascade into account compromise or infrastructure compromise. Organizations using PhpWeasyPrint to generate reports, certificates, or exports should prioritize remediation within 2-4 weeks.

Risk score, explained

The CVSS v3.1 score of 6.5 MEDIUM reflects: (1) network-accessible attack vector (AV:N), (2) low attack complexity (AC:L) once authenticated, (3) requirement for authentication (PR:L), (4) no user interaction needed (UI:N), (5) unchanged scope (S:U), (6) high confidentiality impact (C:H) from file and metadata disclosure, and (7) no integrity or availability impact (I:N, A:N). The score does not account for context-specific factors such as the sensitivity of files the web server can access or the organization's network segmentation. In environments with weak access controls or overpermissioned PHP processes, real-world risk may exceed the base score.

Frequently asked questions