OS Command Injection in Beganovich snappdf

Beganovich snappdf, a library for generating PDFs from URLs in PHP applications, contains a critical OS command injection vulnerability (CVE-2026-110646) affecting versions 1.1.0 through 6.0.x. The vulnerability arises from insufficient sanitization of input passed to the setUrl() method on Windows environments. Specifically, the library's executeOnWindows() function passes the URL parameter unescaped to PHP's exec() system command. An attacker capable of influencing the input to setUrl() can inject shell metacharacters, such as the ampersand (&), to terminate the intended command and execute arbitrary system commands with the privileges of the underlying web server or PHP process. This flaw allows for full system compromise on affected Windows servers running vulnerable versions of the snappdf library.

Impact

Successful exploitation allows for remote code execution (RCE) on Windows-based web servers hosting applications that utilize the vulnerable snappdf library. This can lead to total system compromise, data exfiltration, or deployment of secondary payloads within the target environment. The vulnerability affects any application utilizing snappdf for PDF generation that accepts user-controlled input for the URL parameter.

Recommendation

• Upgrade the snappdf library to version 6.1.0 or later immediately to incorporate proper input sanitization.
• Audit existing PHP application code for any instance of the snappdf library calling setUrl() where the argument is derived from user input.
• Implement strict input validation and allowlisting for any URLs passed to PDF generation functions if upgrading immediately is not feasible.