https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 11:56:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329116 EUVD-2026-329116 https://cve.radiocsirt.org/vuln/euvd-2026-329116 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49260 <p>PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escapeshellarg(&#39;/usr/local/bin/weasyprint&#39;)` returns `&#39;/usr/local/bin/weasyprint&#39;` with the single-quote characters as part of the string, so `is_executable()` looks for a file whose actual name includes those quotes. That file never exists, the &#34;safe&#34; branch is dead code, and the raw `$binary` string (set via the constructor or `setBinary()`) flows directly into `Symfony\Component\Process\Process::fromShellCommandline()`. Any deployment whose binary path is sourced from configuration, an environment variable, or a per-tenant setting reaches a shell-command-injection sink. The library is documented as a one-to-one substitute for KnpLabs/snappy and inherited the exact pre-fix codepath KnpLabs patched in GHSA-vpr4-p6fq-85jc. PhpWeasyPrint version 2.5.1 contains a patch for the issue.</p> <p>PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escapeshellarg(&#39;/usr/local/bin/weasyprint&#39;)` returns `&#39;/usr/local/bin/weasyprint&#39;` with the single-quote characters as part of the string, so `is_executable()` looks for a file whose actual name includes those quotes. That file never exists, the &#34;safe&#34; branch is dead code, and the raw `$binary` string (set via the constructor or `setBinary()`) flows directly into `Symfony\Component\Process\Process::fromShellCommandline()`. Any deployment whose binary path is sourced from configuration, an environment variable, or a per-tenant setting reaches a shell-command-injection sink. The library is documented as a one-to-one substitute for KnpLabs/snappy and inherited the exact pre-fix codepath KnpLabs patched in GHSA-vpr4-p6fq-85jc. PhpWeasyPrint version 2.5.1 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49260 https://cve.radiocsirt.org/vuln/ghsa-f5gc-qxf8-mh9g <p><strong>Affected:</strong> Packagist: pontedilana/php-weasyprint</p> <p>### Summary</p> <p>`pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escapeshellarg(&#39;/usr/local/bin/weasyprint&#39;)` returns `&#39;/usr/local/bin/weasyprint&#39;` with the single-quote characters as part of the string, so `is_executable()` looks for a file whose actual name includes those quotes. That file never exists, the &#34;safe&#34; branch is dead code, and the raw `$binary` string (set via the constructor or `setBinary()`) flows directly into `Symfony\Component\Process\Process::fromShellCommandline()`. Any deployment whose binary path is sourced from configuration, an environment variable, or a per-tenant setting reaches a shell-command-injection sink. The library is documented as a one-to-one substitute for KnpLabs/snappy and inherited the exact pre-fix codepath KnpLabs patched in [GHSA-vpr4-p6fq-85jc](https://github.com/KnpLabs/snappy/security/advisories/GHSA-vpr4-p6fq-85jc) (Snappy 1.7.1).</p> <p>### Affected versions</p> <p>`pontedilana/php-weasyprint` versions `&lt;= 2.5.0` (current `master` tip commit `c2b51fed0bf442c3bf0292b879a09944d436f2a0`, 2026-04-03).</p> <p>Patched in: 2.5.1</p> <p>### Privilege required</p> <p>Any caller that can influence the binary string handed to the `Pdf` constructor or to `AbstractGenerator::setBinary()`. Typical reach paths:</p> <p>- An application config file (`config/services.yaml`, `.env`, helm chart value) read at boot time, where the path i…</p> <p><strong>Affected:</strong> Packagist: pontedilana/php-weasyprint</p> <p>### Summary</p> <p>`pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escapeshellarg(&#39;/usr/local/bin/weasyprint&#39;)` returns `&#39;/usr/local/bin/weasyprint&#39;` with the single-quote characters as part of the string, so `is_executable()` looks for a file whose actual name includes those quotes. That file never exists, the &#34;safe&#34; branch is dead code, and the raw `$binary` string (set via the constructor or `setBinary()`) flows directly into `Symfony\Component\Process\Process::fromShellCommandline()`. Any deployment whose binary path is sourced from configuration, an environment variable, or a per-tenant setting reaches a shell-command-injection sink. The library is documented as a one-to-one substitute for KnpLabs/snappy and inherited the exact pre-fix codepath KnpLabs patched in [GHSA-vpr4-p6fq-85jc](https://github.com/KnpLabs/snappy/security/advisories/GHSA-vpr4-p6fq-85jc) (Snappy 1.7.1).</p> <p>### Affected versions</p> <p>`pontedilana/php-weasyprint` versions `&lt;= 2.5.0` (current `master` tip commit `c2b51fed0bf442c3bf0292b879a09944d436f2a0`, 2026-04-03).</p> <p>Patched in: 2.5.1</p> <p>### Privilege required</p> <p>Any caller that can influence the binary string handed to the `Pdf` constructor or to `AbstractGenerator::setBinary()`. Typical reach paths:</p> <p>- An application config file (`config/services.yaml`, `.env`, helm chart value) read at boot time, where the path i…</p> https://cve.radiocsirt.org/vuln/ghsa-f5gc-qxf8-mh9g