Search criteria
Related vulnerabilities
GHSA-C5FP-P67M-GQ56
Vulnerability from github – Published: 2026-05-21 20:20 – Updated: 2026-05-21 20:20
VLAI
Summary
Snappy : SSRF and local file read via the xsl-style-sheet option
Details
Impact
It impacts applications where: - the PHP daemon run with root permissions ; - the application is either running outside a container or has sensitive file access ;
It could happens with this kind of workflows:
$stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
$pdf->generate(‘page.html’, ‘out.pdf’, [
‘xsl-style-sheet’ => $stylesheet
]);
Patches
A list a schema with http and https by default is used to validate the remote path by default.
Workarounds
Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library.
// Bad example
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
$pdf->generate(‘page.html’, ‘out.pdf’, [
‘xsl-style-sheet’ => $_GET['input'],
]);
Instead developers can list available available stylesheets and pick the right one with the user input.
// Better
$allowedStylesheets = [
'invoice' => '/app/xsl/invoice.xsl',
'report' => '/app/xsl/report.xsl',
];
$key = $_GET['stylesheet'] ?? '';
if (!array_key_exists($key, $allowedStylesheets)) {
throw new \RuntimeException('Unknown stylesheet.');
}
$pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf');
$pdf->generate('page.html', 'out.pdf', [
'xsl-style-sheet' => $allowedStylesheets[$key],
]);
References
Read more about SSRF at owasp.org/www-community/attacks/Server_Side_Request_Forgery
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.6.0"
},
"package": {
"ecosystem": "Packagist",
"name": "knplabs/knp-snappy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46683"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-21T20:20:01Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n\nIt impacts applications where:\n- the PHP daemon run with root permissions ;\n- the application is either running outside a container or has sensitive file access ;\n\nIt could happens with this kind of workflows:\n\n```php\n$stylesheet = $_GET[\u0027stylesheet\u0027]; // = \u2018file:///etc/passwd\u2019\n$pdf = new Knp\\Snappy\\Pdf(\u2018/usr/local/bin/wkhtmltopdf\u2019);\n $pdf-\u003egenerate(\u2018page.html\u2019, \u2018out.pdf\u2019, [\n \u2018xsl-style-sheet\u2019 =\u003e $stylesheet\n ]);\n```\n\n### Patches\n\nA list a schema with `http` and `https` by default is used to validate the remote path by default.\n\n### Workarounds\n\nDevelopers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library.\n\n```php\n// Bad example\n$pdf = new Knp\\Snappy\\Pdf(\u2018/usr/local/bin/wkhtmltopdf\u2019);\n $pdf-\u003egenerate(\u2018page.html\u2019, \u2018out.pdf\u2019, [\n \u2018xsl-style-sheet\u2019 =\u003e $_GET[\u0027input\u0027],\n ]);\n```\n\nInstead developers can list available available stylesheets and pick the right one with the user input.\n\n```php\n// Better\n$allowedStylesheets = [\n \u0027invoice\u0027 =\u003e \u0027/app/xsl/invoice.xsl\u0027,\n \u0027report\u0027 =\u003e \u0027/app/xsl/report.xsl\u0027,\n];\n\n$key = $_GET[\u0027stylesheet\u0027] ?? \u0027\u0027;\n\nif (!array_key_exists($key, $allowedStylesheets)) {\n throw new \\RuntimeException(\u0027Unknown stylesheet.\u0027);\n}\n\n$pdf = new Knp\\Snappy\\Pdf(\u0027/usr/local/bin/wkhtmltopdf\u0027);\n$pdf-\u003egenerate(\u0027page.html\u0027, \u0027out.pdf\u0027, [\n \u0027xsl-style-sheet\u0027 =\u003e $allowedStylesheets[$key],\n]);\n```\n\n### References\n\nRead more about SSRF at [owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)",
"id": "GHSA-c5fp-p67m-gq56",
"modified": "2026-05-21T20:20:01Z",
"published": "2026-05-21T20:20:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56"
},
{
"type": "PACKAGE",
"url": "https://github.com/KnpLabs/snappy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Snappy : SSRF and local file read via the xsl-style-sheet option"
}