CVE-2026-49358

Packagist/pontedilana/php-weasyprint CVE-2026-49358: low 3

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

Action: Upgrade pontedilana/php-weasyprint to 2.6.0 or later.

composer require pontedilana/php-weasyprint:2.6.0

Affected

Fixed versions

Sources

• osv: GHSA-5g9f-cwwg-4p8g
• https://github.com/KnpLabs/snappy/security/advisories/GHSA-87qc-37cw-84h4
• https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-5g9f-cwwg-4p8g
• https://nvd.nist.gov/vuln/detail/CVE-2026-49358
• https://github.com/pontedilana/php-weasyprint/commit/6d328ffd3bcb800c7c2e8a594b1bff0c099c9391
• https://github.com/pontedilana/php-weasyprint
• https://github.com/pontedilana/php-weasyprint/releases/tag/2.6.0

CVE-2026-49358 · published 2026-06-26T22:10:51Z · modified 2026-09-10T03:50:48.319605683Z · JSON