CVE-2026-49286

Packagist/pontedilana/php-weasyprint CVE-2026-49286: high 8.1, EPSS 0.95%

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Action: Upgrade pontedilana/php-weasyprint to 2.6.0 or later.

composer require pontedilana/php-weasyprint:2.6.0

Affected

Fixed versions

Sources

• osv: GHSA-2fmj-p74r-3wjm
• https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj
• https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-2fmj-p74r-3wjm
• https://nvd.nist.gov/vuln/detail/CVE-2026-49286
• https://github.com/pontedilana/php-weasyprint/commit/d1aa487722b5a3cab9b222b85fdb5608a5a550c3
• https://github.com/pontedilana/php-weasyprint
• https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0

CVE-2026-49286 · published 2026-06-26T22:10:00Z · modified 2026-09-10T03:51:07.450570996Z · JSON