CVE-2026-110646
Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()
- State
- Published
- Severity
- 9.2 Critical
- Published
- Oct 14, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 14, 2026
Description
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
snappdfbeganovich |
|
References
- https://github.com/beganovich/snappdf/pull/54patchissue-tracking
- https://github.com/beganovich/snappdf/commit/5197bd3bcc4df44e17246dbceea9ce51eb390eaepatch
- https://github.com/beganovich/snappdf/blob/v6.0.0/src/Snappdf.php#L280-L284technical-description
- snappdf v6.1.0 Release Notesrelease-notes
- VulnCheck Advisory: Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.