CVE-2023-28115

CVE-2023-28115 affects the knplabs/knp-snappy PHP library (Pdf/Html generation) prior to version 1.4.2. The root cause is a lack of validation for the protocol passed into file_exists(), allowing an attacker who can upload files to trigger PHAR deserialization via the phar:// wrapper and potentia...

CVE-2023-41330

CVE-2023-41330 affects knplabs/knp-snappy (PHP library for thumbnail/snapshot/PDF generation). The issue is a unsafe PHAR deserialization vulnerability related to how output filenames are handled when generateFromHtml() can be controlled and passed to prepareOutput(). Although a patch was added i...