CVE-2026-46683

描述

### Impact It impacts applications where: - the PHP daemon run with root permissions ; - the application is either running outside a container or has sensitive file access ; It could happens with this kind of workflows: ```php $stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’ $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $stylesheet ]); ``` ### Patches A list a schema with `http` and `https` by default is used to validate the remote path by default. ### Workarounds Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library. ```php // Bad example $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $_GET['input'], ]); ``` Instead developers can list available available stylesheets and pick the right one with the user input. ```php // Better $allowedStylesheets = [ 'invoice' => '/app/xsl/invoice.xsl', 'report' => '/app/xsl/report.xsl', ]; $key = $_GET['stylesheet'] ?? ''; if (!array_key_exists($key, $allowedStylesheets)) { throw new \RuntimeException('Unknown stylesheet.'); } $pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf'); $pdf->generate('page.html', 'out.pdf', [ 'xsl-style-sheet' => $allowedStylesheets[$key], ]); ``` ### References Read more about SSRF at [owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)

如何修補 CVE-2026-46683

要修補 CVE-2026-46683,請將受影響套件升級到下列已修補版本。

• —升級至 1.7.0 或更新版本

CVE-2026-46683 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.7.0