Shell Command Injection in pontedilana/php-weasyprint via is_executable guard bypass

Vulnerability Overview Vulnerability Name: php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted guard Vulnerability Description: The library escapes the binary path using when constructing the shell command for WeasyPrint, then checks the escaped result using . On POSIX systems, returns , where the single quotes are part of the string. Consequently, looks for a file that literally contains these quotes, which typically does not exist. As a result, returns , causing to return the raw, unescaped string directly. This leads to shell command injection vulnerabilities in any deployment where the binary path is derived from configuration files, environment variables, or per-tenant settings. Scope of Impact Affected Versions: version <= 2.5.0 Fixed Version: 2.5.1 CVSS Score: 8.2 / 10 Vulnerability Type: CWE-78 (OS Command Injection) Privilege Requirements: Any caller capable of influencing the binary string passed to the constructor or . Typical vectors include: - Application configuration files (e.g., , , Helm chart values) read at startup, with automatic path detection or per-tenant overrides. - Admin UIs allowing operators to select between multiple WeasyPrint builds (e.g., , ) for compatibility purposes. - Multi-tenant SaaS applications resolving binary locations from tenant configurations. Remediation Recommended Fix: Mirror the fix from 1.7.1 by explicitly implementing the method as follows: Fix Explanation: Run on the unescaped . For attacker-controlled payloads, will return (as no file with that name exists on disk), causing an exception to be thrown before is invoked, ensuring the malicious file is never created. For legitimate paths, returns , providing defense-in-depth that is effective for every deployment, not just against malicious payloads. Proof of Concept (POC) Code Impact Severity: High Impact: - PHP-FPM / CLI users suffer from shell command injection whenever the WeasyPrint binary path is influenced by configuration, environment variables, or per-tenant settings. - This affects any consumer that does not hardcode constant binary paths. Empirically, the project's own README and tests indicate that binary paths are passed as configurable constructor arguments (e.g., ), and downstream framework integrations (Symfony / Laravel) typically pass them via container configuration. - Defense-in-depth is lost even for hardcoded paths, because reasonably assumes the binary will be shell-escaped due to the code's visual appearance. Any change to read the binary from less trusted sources inherits this vulnerability. Credits Reporter: tonghuanoat

Goal Reached Thanks to every supporter — we hit 100%!

Shell Command Injection in pontedilana/php-weasyprint via is_executable guard bypass

More from this source