CVE-2026-49358

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, "AbstractGenerator::$temporaryFiles" is a public array, and "removeTemporaryFiles" — invoked from "destruct" and from a registered shutdown function — calls "unlink" on every entry without...

CVE-2026-49358: External Control of File Name or Path

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, AbstractGenerator::$temporaryFiles is a public array, and removeTemporaryFiles — invoked from destruct and from a registered shutdown function — calls unlink on every entry without verifying...