GHSA-C5FP-P67M-GQ56

Vulnerability from github – Published: 2026-05-21 20:20 – Updated: 2026-06-11 13:30
VLAI
Summary
Snappy : SSRF and local file read via the xsl-style-sheet option
Details

Impact

It impacts applications where: - the PHP daemon run with root permissions ; - the application is either running outside a container or has sensitive file access ;

It could happens with this kind of workflows:

$stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
 $pdf->generate(‘page.html’, ‘out.pdf’, [
   ‘xsl-style-sheet’ => $stylesheet
 ]);

Patches

A list a schema with http and https by default is used to validate the remote path by default.

Workarounds

Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library.

// Bad example
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
 $pdf->generate(‘page.html’, ‘out.pdf’, [
   ‘xsl-style-sheet’ => $_GET['input'],
 ]);

Instead developers can list available available stylesheets and pick the right one with the user input.

// Better
$allowedStylesheets = [
    'invoice' => '/app/xsl/invoice.xsl',
    'report'  => '/app/xsl/report.xsl',
];

$key = $_GET['stylesheet'] ?? '';

if (!array_key_exists($key, $allowedStylesheets)) {
    throw new \RuntimeException('Unknown stylesheet.');
}

$pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf');
$pdf->generate('page.html', 'out.pdf', [
    'xsl-style-sheet' => $allowedStylesheets[$key],
]);

References

Read more about SSRF at owasp.org/www-community/attacks/Server_Side_Request_Forgery

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "knplabs/knp-snappy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46683"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-21T20:20:01Z",
    "nvd_published_at": "2026-06-10T20:17:29Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIt impacts applications where:\n- the PHP daemon run with root permissions ;\n- the application is either running outside a container or has sensitive file access ;\n\nIt could happens with this kind of workflows:\n\n```php\n$stylesheet = $_GET[\u0027stylesheet\u0027]; // = \u2018file:///etc/passwd\u2019\n$pdf = new Knp\\Snappy\\Pdf(\u2018/usr/local/bin/wkhtmltopdf\u2019);\n $pdf-\u003egenerate(\u2018page.html\u2019, \u2018out.pdf\u2019, [\n   \u2018xsl-style-sheet\u2019 =\u003e $stylesheet\n ]);\n```\n\n### Patches\n\nA list a schema with `http` and `https` by default is used to validate the remote path by default.\n\n### Workarounds\n\nDevelopers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library.\n\n```php\n// Bad example\n$pdf = new Knp\\Snappy\\Pdf(\u2018/usr/local/bin/wkhtmltopdf\u2019);\n $pdf-\u003egenerate(\u2018page.html\u2019, \u2018out.pdf\u2019, [\n   \u2018xsl-style-sheet\u2019 =\u003e $_GET[\u0027input\u0027],\n ]);\n```\n\nInstead developers can list available available stylesheets and pick the right one with the user input.\n\n```php\n// Better\n$allowedStylesheets = [\n    \u0027invoice\u0027 =\u003e \u0027/app/xsl/invoice.xsl\u0027,\n    \u0027report\u0027  =\u003e \u0027/app/xsl/report.xsl\u0027,\n];\n\n$key = $_GET[\u0027stylesheet\u0027] ?? \u0027\u0027;\n\nif (!array_key_exists($key, $allowedStylesheets)) {\n    throw new \\RuntimeException(\u0027Unknown stylesheet.\u0027);\n}\n\n$pdf = new Knp\\Snappy\\Pdf(\u0027/usr/local/bin/wkhtmltopdf\u0027);\n$pdf-\u003egenerate(\u0027page.html\u0027, \u0027out.pdf\u0027, [\n    \u0027xsl-style-sheet\u0027 =\u003e $allowedStylesheets[$key],\n]);\n```\n\n### References\n\nRead more about SSRF at [owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)",
  "id": "GHSA-c5fp-p67m-gq56",
  "modified": "2026-06-11T13:30:20Z",
  "published": "2026-05-21T20:20:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/KnpLabs/snappy/security/advisories/GHSA-c5fp-p67m-gq56"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46683"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/KnpLabs/snappy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KnpLabs/snappy/releases/tag/v1.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Snappy : SSRF and local file read via the xsl-style-sheet option"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.