GHSA-c5fp-p67m-gq56

Опубликовано: 21 мая 2026

Источник: github

Github: Прошло ревью

CVSS4: 6.9

Описание

Snappy : SSRF and local file read via the xsl-style-sheet option

Impact

It impacts applications where:

the PHP daemon run with root permissions ;
the application is either running outside a container or has sensitive file access ;

It could happens with this kind of workflows:

$stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’ $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $stylesheet ]);

Patches

A list a schema with http and https by default is used to validate the remote path by default.

Workarounds

Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library.

// Bad example $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $_GET['input'], ]);

Instead developers can list available available stylesheets and pick the right one with the user input.

// Better $allowedStylesheets = [ 'invoice' => '/app/xsl/invoice.xsl', 'report' => '/app/xsl/report.xsl', ]; $key = $_GET['stylesheet'] ?? ''; if (!array_key_exists($key, $allowedStylesheets)) { throw new \RuntimeException('Unknown stylesheet.'); } $pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf'); $pdf->generate('page.html', 'out.pdf', [ 'xsl-style-sheet' => $allowedStylesheets[$key], ]);

References

Ссылки

Пакеты

Наименование

knplabs/knp-snappy

composer

Затронутые версииВерсия исправления

<= 1.6.0

1.7.0

EPSS

Процентиль: 16%

0.00249

Низкий

6.9 Medium

CVSS4

CVE ID

CVE-2026-46683

Дефекты

CWE-918

Связанные уязвимости

CVE-2026-46683

nvd

около 2 месяцев назад

Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.7.0, there is a SSRF and local file read vulnerability via the xsl-style-sheet option. This issue has been patched in version 1.7.0.

CVE-2026-46683

msrc

около 2 месяцев назад

Snappy: SSRF and local file read via the xsl-style-sheet option

EPSS

Процентиль: 16%

0.00249

Низкий

6.9 Medium

CVSS4

CVE ID

CVE-2026-46683

Дефекты

CWE-918