KnpLabs vulnerabilities
We track 3 vulnerabilities in KnpLabs products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 10, 2026.
Latest KnpLabs vulnerabilities
- 7.5 High severity
snappy: Improper Neutralization of Special Elements used in an OS Command
Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.7.1, on POSIX, escapeshellarg(‘/usr/bin/wkhtmltopdf’) returns the literal string ‘/usr/bin/wkhtmltopdf’ with the single-quote characters includ
- 9.8 Critical severity
snappy: Deserialization of Untrusted Data
knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. ## Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization
- 9.8 Critical severity
snappy: Deserialization of Untrusted Data
Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function