{"id":"GHSA-5g9f-cwwg-4p8g","summary":"PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles","details":"### Summary\n\n`AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown.\n\nThis mirrors the KnpLabs/snappy issue [GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4), patched in snappy 1.7.2.\n\n### Affected versions\n\n`pontedilana/php-weasyprint` versions `\u003c= 2.5.1`.\n\nPatched in: `2.6.0`.\n\n### Vulnerable code\n\n`src/AbstractGenerator.php`:\n\n```php\npublic array $temporaryFiles = [];\n\n// ...\n\npublic function removeTemporaryFiles(): void\n{\n    foreach ($this-\u003etemporaryFiles as $file) {\n        $this-\u003eunlink($file);\n    }\n}\n```\n\nNo path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked.\n\n### Proof of concept\n\n```php\n\u003c?php\nuse Pontedilana\\PhpWeasyPrint\\Pdf;\n\n$pdf = new Pdf();\n$pdf-\u003etemporaryFiles[] = '/var/www/html/.env';\n\n// On shutdown, removeTemporaryFiles() deletes /var/www/html/.env.\n```\n\n### Impact\n\n- Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user.\n- Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is **amplification**: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive.\n\nCWE-73 (External Control of File Name or Path).\n\n### Suggested fix\n\nOnly delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths:\n\n```php\npublic function removeTemporaryFiles(): void\n{\n    $temporaryFolderPath = \\realpath($this-\u003egetTemporaryFolder());\n    if (false === $temporaryFolderPath) {\n        return;\n    }\n    $temporaryFolderPath = \\rtrim($temporaryFolderPath, \\DIRECTORY_SEPARATOR) . \\DIRECTORY_SEPARATOR;\n\n    foreach ($this-\u003etemporaryFiles as $file) {\n        $filePath = \\realpath($file);\n        if (false === $filePath || 0 !== \\strncmp($filePath, $temporaryFolderPath, \\strlen($temporaryFolderPath))) {\n            continue;\n        }\n        $this-\u003eunlink($file);\n    }\n}\n```\n\n(The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.)\n\n### Credit\n\nReported upstream to KnpLabs/snappy ([GHSA-87qc-37cw-84h4](https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4)); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.","aliases":["CVE-2026-49358"],"modified":"2026-08-24T00:36:53.500427218Z","published":"2026-06-26T22:10:51Z","related":["CVE-2026-49358"],"database_specific":{"cwe_ids":["CWE-73"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-06-26T22:10:51Z","nvd_published_at":"2026-06-19T15:16:35Z"},"references":[{"type":"WEB","url":"https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4"},{"type":"WEB","url":"https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49358"},{"type":"WEB","url":"https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391"},{"type":"PACKAGE","url":"https://github.com/pontedilana/php-weasyprint"},{"type":"WEB","url":"https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0"}],"affected":[{"package":{"name":"pontedilana/php-weasyprint","ecosystem":"Packagist","purl":"pkg:composer/pontedilana/php-weasyprint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.12.0","0.13.0","0.9.0","1.0.0","1.0.1","1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.5.0","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.5.0","2.5.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.5.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5g9f-cwwg-4p8g/GHSA-5g9f-cwwg-4p8g.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L"}]}