php-weasyprint vulnerabilities

2 known vulnerabilities in php-weasyprint from Pontedilana. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  php-weasyprint: Deserialization of Untrusted Data

  CVE-2026-49286Jun 19, 2026Pontedilana

  PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are ca

• 8.2 High severity

  php-weasyprint: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-49260Jun 19, 2026Pontedilana

  PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *q