CVE-2026-49260

creationtimestamp| type| source ---|---|--- 2026-06-19 17:53:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monvvf7aa22k 2026-06-26 22:35:24+00:00| published-proof-of-concept| https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-f5gc-qxf8-mh9g...

CVE-2026-49260

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, pontedilana/php-weasyprint builds the shell command for WeasyPrint by passing the binary path through escapeshellarg first and then checking the quoted result with isexecutable. On POSIX...