pontedilana php-weasyprint

• CVE-2026-49359 Medium 6.5 PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option 0.4%
• CVE-2026-49286 High 8.1 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass) 0.7%
• CVE-2026-49260 High 8.2 PhpWeasyPrint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc) 0.2%
• CVE-2026-49358 Low 3.0 PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles 0.2%