CVE-2026-46683: Snappy PHP Library SSRF Vulnerability

CVE-2026-46683 Overview

CVE-2026-46683 is a Server-Side Request Forgery (SSRF) and local file read vulnerability in Snappy, a PHP library used to generate thumbnails, snapshots, and PDFs from URLs or HTML pages. The flaw exists in the handling of the xsl-style-sheet option in versions prior to 1.7.0. Attackers can abuse this option to force the underlying renderer to fetch arbitrary URLs or read local files from the server's filesystem. The maintainers, KnpLabs, patched the issue in Snappy version 1.7.0. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can read local files and pivot requests through the server to reach internal network resources, exposing sensitive configuration data and internal services.

Affected Products

KnpLabs Snappy PHP library versions prior to 1.7.0
PHP applications integrating Snappy for PDF, thumbnail, or snapshot generation
Downstream frameworks and bundles that wrap Snappy (for example, KnpSnappyBundle for Symfony)

Discovery Timeline

2026-06-10 - CVE-2026-46683 published to NVD
2026-06-10 - Last updated in NVD database
Patch released - KnpLabs publishes Snappy v1.7.0 with the fix
Advisory published - GitHub Security Advisory GHSA-c5fp-p67m-gq56 released

Technical Details for CVE-2026-46683

Vulnerability Analysis

Snappy wraps the wkhtmltopdf and wkhtmltoimage binaries to convert HTML or URLs into PDFs and images. The library accepts a wide range of options that map directly to command-line flags passed to those binaries. The xsl-style-sheet option specifies an XSLT stylesheet that the renderer applies during conversion.

When application code accepts user-controlled input and passes it into Snappy's options array without restriction, an attacker can set xsl-style-sheet to an arbitrary URL or local file path. The underlying renderer then fetches that resource on behalf of the server. This grants the attacker SSRF capabilities against internal network endpoints and arbitrary file read against any path readable by the PHP process.

Root Cause

The root cause is missing validation of the xsl-style-sheet option value before it is forwarded to the rendering binary. Snappy treated the option as trusted configuration rather than potentially attacker-controlled input. Applications that exposed option setters to end users inherited the unvalidated pass-through, producing the SSRF and local file read primitives described in CWE-918.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction in applications that allow client-supplied options or templates to influence the Snappy invocation. An attacker submits a request containing an xsl-style-sheet value pointing to an internal URL such as a cloud metadata endpoint, an internal admin service, or a file:// URI referencing /etc/passwd or application configuration files. The generated PDF or image contains the fetched content, or the server-side request leaks information through timing, errors, or output reflection.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-c5fp-p67m-gq56 for the maintainer's technical description.

Detection Methods for CVE-2026-46683

Indicators of Compromise

Outbound HTTP requests from PHP application servers to internal IP ranges, cloud metadata services such as 169.254.169.254, or unexpected external hosts originating from wkhtmltopdf or wkhtmltoimage processes
Process executions of wkhtmltopdf or wkhtmltoimage with --xsl-style-sheet arguments referencing file://, http://, or unexpected paths
Application logs containing user-supplied xsl-style-sheet parameters in PDF or thumbnail generation endpoints

Detection Strategies

Audit application source code for calls to Snappy methods such as setOption('xsl-style-sheet', ...) where the value derives from request input
Inspect installed Composer dependencies for knplabs/knp-snappy versions below 1.7.0 using composer show knplabs/knp-snappy
Monitor egress traffic from web tiers for connections initiated by rendering binaries to internal subnets or metadata endpoints

Monitoring Recommendations

Forward web application logs and process telemetry into a centralized analytics platform and alert on wkhtmltopdf invocations referencing file:// URIs or RFC1918 addresses
Enable command-line argument capture in endpoint telemetry on Linux hosts running PHP application servers
Track DNS queries from application servers for cloud metadata hostnames and internal-only domains during PDF or thumbnail generation

How to Mitigate CVE-2026-46683

Immediate Actions Required

Upgrade knplabs/knp-snappy to version 1.7.0 or later in all PHP projects
Review application code paths that expose Snappy options to user input and remove or allowlist the xsl-style-sheet option
Restrict egress network access from PHP application servers to only required destinations using host firewalls or network policy

Patch Information

The fix is included in Snappy v1.7.0. Update via Composer:

bash

composer require knplabs/knp-snappy:^1.7.0

Review the GitHub Security Advisory GHSA-c5fp-p67m-gq56 for full advisory details.

Workarounds

Filter and validate all Snappy option keys and values against an allowlist before invocation, denying xsl-style-sheet from untrusted sources
Run wkhtmltopdf and wkhtmltoimage under a dedicated low-privilege user with no read access to sensitive files
Block outbound connections from rendering processes to internal networks and cloud metadata endpoints at the network layer