HIGH8.1Packagist
GHSA-2fmj-p74r-3wjm· CVE-2026-49286PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Modified: 9/10/2026
package
Packagist/pontedilana/php-weasyprint
pkg:packagist/pontedilana/php-weasyprint
LOW3.0Packagist
GHSA-5g9f-cwwg-4p8g· CVE-2026-49358PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
Modified: 9/10/2026
HIGH8.2Packagist
GHSA-f5gc-qxf8-mh9g· CVE-2026-49260php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
Modified: 9/10/2026
MEDIUM6.5Packagist
GHSA-x8g9-h984-pc36· CVE-2026-49359PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
Modified: 9/10/2026