CVE-2026-46643: Snappy PHP Library RCE Vulnerability

CVE-2026-46643 Overview

CVE-2026-46643 is a command injection vulnerability in Snappy, a PHP library that generates thumbnails, snapshots, and PDFs from URLs or HTML pages. The flaw affects all versions prior to 1.7.1 and stems from improperly escaped binary path handling on POSIX systems. The library's safe-execution branch becomes dead code, causing the raw, unescaped binary path to be passed to shell execution. Attackers who can influence the binary path through configuration, environment variables, or user-controlled fragments can inject arbitrary shell commands. The issue is tracked as [CWE-78] (OS Command Injection) and was patched in version 1.7.1.

Critical Impact
Attackers controlling the wkhtmltopdf binary path can execute arbitrary OS commands with the privileges of the PHP process, leading to full application compromise.

Affected Products

KnpLabs Snappy PHP library versions prior to 1.7.1
PHP applications running on POSIX systems using Snappy for PDF or image generation
Web applications that source the wkhtmltopdf binary path from user-influenced configuration or environment variables

Discovery Timeline

2026-06-10 - CVE-2026-46643 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46643

Vulnerability Analysis

The vulnerability resides in Snappy's command construction logic for invoking the wkhtmltopdf binary. On POSIX systems, the library calls escapeshellarg('/usr/bin/wkhtmltopdf'), which returns the literal string with single-quote characters wrapped around it. The subsequent is_executable() check then searches for a file whose actual name contains those literal quote characters. No such file exists on a normal filesystem, so the check always fails.

Because the safe branch is never taken, the $command variable falls through to the raw, unescaped binary path value. The remaining arguments such as options, input, and output are escaped correctly, so injection must occur within the binary path string itself. This restricts exploitation to scenarios where the binary path itself is influenced by attacker-controlled input.

Root Cause

The root cause is incorrect use of escapeshellarg() followed by an is_executable() validation that operates on the escaped string rather than the raw path. The quoting characters break the file existence check, making the safe branch unreachable. This is a logic error in input validation combined with an OS command injection sink [CWE-78].

Attack Vector

Exploitation requires the binary path to originate from a source an attacker can influence. Typical scenarios include configuration files populated from request data, environment variables derived from HTTP headers, or string concatenation that mixes a base path with user-controlled fragments. An attacker who controls any portion of the binary path string can inject shell metacharacters that execute alongside the intended wkhtmltopdf invocation. Successful exploitation yields command execution under the PHP-FPM or web server user account.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-vpr4-p6fq-85jc for the maintainer's technical description.

Detection Methods for CVE-2026-46643

Indicators of Compromise

Unexpected child processes spawned by PHP-FPM, Apache, or Nginx worker processes that do not match the legitimate wkhtmltopdf invocation pattern
Shell metacharacters such as ;, |, &, $(), or backticks appearing in Snappy configuration values, environment variables, or audit logs
Outbound network connections from the PHP process to unfamiliar hosts shortly after PDF or thumbnail generation requests

Detection Strategies

Audit application code for any call path where the Snappy binary path is set from $_GET, $_POST, $_SERVER, getenv(), or other request-influenced sources
Monitor process execution telemetry for wkhtmltopdf parent-child relationships and flag any invocation containing shell metacharacters in the executable argument
Review composer.lock files across PHP projects to identify installations of knplabs/knp-snappy below version 1.7.1

Monitoring Recommendations

Enable PHP disable_functions audit logging for shell_exec, proc_open, and exec calls originating from Snappy code paths
Forward web server and PHP-FPM process telemetry to a centralized log platform and alert on anomalous shell command patterns
Track configuration file changes that modify the wkhtmltopdf binary path setting

How to Mitigate CVE-2026-46643

Immediate Actions Required

Upgrade knplabs/knp-snappy to version 1.7.1 or later using composer update knplabs/knp-snappy
Audit all application code that sets the Snappy binary path and remove any user-influenced input from that configuration value
Hardcode the wkhtmltopdf binary path as a string literal in deployment configuration rather than sourcing it from runtime data

Patch Information

The maintainers fixed this issue in Snappy version 1.7.1. The patch corrects the escape and validation logic so that is_executable() operates on the raw path and the binary string is properly handled before shell invocation. Release details are available in the GitHub Snappy Release v1.7.1 notes.

Workarounds

Restrict the PHP process account to the minimum filesystem and network privileges required for legitimate operation
Validate the Snappy binary path against a strict allowlist of fully qualified filesystem locations before instantiating the library
Run PDF generation workloads inside an isolated container or sandbox with no shell interpreter available

bash

# Update Snappy to the patched version
composer require knplabs/knp-snappy:^1.7.1
composer update knplabs/knp-snappy

# Verify installed version
composer show knplabs/knp-snappy | grep versions