6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46683

CVE-2026-46683: Snappy: SSRF and local file read via the xsl-style-sheet option

Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.7.0, there is a SSRF and local file read vulnerability via the xsl-style-sheet option. This issue has been patched in version 1.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46683

CVE-2026-46683:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
knplabs/knp-snappy	composer	<= 1.6.0	1.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI) found in the knplabs/knp-snappy library. The root cause is located in the Knp\Snappy\Pdf::isOptionUrl method. The original implementation used PHP's filter_var function with the FILTER_VALIDATE_URL flag to check if an option value was a URL. This filter is notoriously permissive and validates URLs with schemes like file://, which an attacker can abuse.

The exploit is triggered when a developer uses the Knp\Snappy\Pdf::generate method and passes untrusted user input into the $options array, specifically for the xsl-style-sheet key. An attacker could provide a payload like file:///etc/passwd.

During the PDF generation process, the generate method (from the parent AbstractGenerator class) processes the provided options. It calls the isOptionUrl method to determine how to handle the option value. The vulnerable version of isOptionUrl would incorrectly validate the file:// path as a valid URL, causing the underlying wkhtmltopdf binary to read the local file and embed its content, or make requests to internal network resources.

The patch addresses this by completely replacing the logic in isOptionUrl. The new implementation parses the URL and explicitly checks its scheme against a configurable allowlist, which defaults to only http and https. The Knp\Snappy\Pdf constructor was also updated to allow developers to customize this list of allowed schemes if needed.

Vulnerable functions

Knp\Snappy\Pdf::isOptionUrl

src/Knp/Snappy/Pdf.php

The vulnerability lies in the `isOptionUrl` function. Before the patch, it used `filter_var` with `FILTER_VALIDATE_URL`, which improperly validated URLs, allowing schemes like `file://`. This permitted an attacker to specify local files (e.g., 'file:///etc/passwd') in options like 'xsl-style-sheet', leading to Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF). The patch replaces this with a strict check against an allowed list of schemes (http, https by default).

Knp\Snappy\Pdf::__construct

src/Knp/Snappy/Pdf.php

The constructor was modified to introduce the security mitigation. It now accepts an `$allowedSchemes` parameter, which is used by the patched `isOptionUrl` function to validate URLs. While not directly vulnerable, this function is part of the patch and is critical to understanding how the vulnerability was fixed. It initializes the new security control.

Knp\Snappy\AbstractGenerator::generate

src/Knp/Snappy/AbstractGenerator.php

This is the primary user-facing function that triggers the vulnerability. An attacker provides a malicious payload (e.g., a `file://` path) as a value for the `xsl-style-sheet` option within the `$options` array passed to this method. The `generate` method then internally processes these options, leading to the execution of the vulnerable `isOptionUrl` logic.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.