CVE-2026-49286 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Attackers can achieve remote code execution by bypassing case-sensitive filename checks to trigger PHAR deserialization in PhpWeasyPrint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49286?
CVE-2026-49286 is a high-severity unsafe deserialization vulnerability in pontedilana php-weasyprint, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue.
Weakness: CWE-502
Which versions are affected by CVE-2026-49286?
2 open source packages ship an affected version, including pontedilana/php-weasyprint.
| Package | Affected | Fixed in |
|---|---|---|
pontedilana/php-weasyprint Packagist | All versions | 2.6.0 |
pontedilana/php-weasyprint Packagist | All versions | 2.6.0 |
How do I fix CVE-2026-49286?
Upgrade pontedilana/php-weasyprint to 2.6.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-49286 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49286 exists.
Sources
Also known as GHSA-2fmj-p74r-3wjm.