CVE-2023-28115
published 2023-03-17CVE-2023-28115: Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.76%
84.4th percentile
Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromHtml()` function, it will invoke deserialization. This vulnerability is capable of remote code execution if Snappy is used with frameworks or developer code with vulnerable POP chains. It has been fixed in version 1.4.2.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | civicrm | — | — |
| knplabs | knp-snappy | >= 0 < 1.4.2 | 1.4.2 |
| knplabs | knp-snappy | >= 0 < 1.4.3 | 1.4.3 |
| knplabs | snappy | < 1.4.2 | 1.4.2 |
| knplabs | snappy | < 1.4.3 | 1.4.3 |
| pontedilana | php-weasyprint | < 2.6.0 | 2.6.0 |
| pontedilana | php-weasyprint | >= 0 < 2.6.0 | 2.6.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect use of phar:// protocol being passed into file_exists() calls within Snappy library context, which triggers PHAR deserialization ↗
- →Monitor for attacker-controlled output file arguments to generateFromHtml() containing phar:// URI scheme, which will invoke deserialization ↗
- →Flag any file upload followed by a phar:// protocol reference in application input, especially in environments using Laravel or Symfony POP chains alongside Snappy ↗
- ·Vulnerability only exploitable if attacker can upload arbitrary files to the server AND control input to Snappy functions; both conditions must be met for RCE ↗
- ·RCE impact is conditional on the presence of exploitable POP chains in co-deployed frameworks (e.g., Laravel, Symfony) or vulnerable developer code ↗
- ·Debian bullseye remains unpatched (open) as of the security tracker; fix is available only in Snappy version 1.4.2 and later ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
ghsa·2026-06-26·CVSS 9.8
CVE-2026-49286 [CRITICAL] CWE-502 PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
### Summary
`pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist:
```php
if (0 === \strpos($filename, 'phar://')) {
throw new \InvalidArgumentException('The output file cannot be a phar archive.');
}
```
PHP stream wrappers are **case-insensitive**, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115.
The same issue and fix were handled upstream in
GHSA
Snappy PHAR deserialization vulnerability
ghsa·2023-09-08·CVSS 9.8
CVE-2023-41330 [CRITICAL] CWE-502 Snappy PHAR deserialization vulnerability
Snappy PHAR deserialization vulnerability
## Issue
On March 17th the vulnerability [CVE-2023-28115 was disclosed](https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc), allowing an attacker to gain remote code execution through PHAR deserialization. To fix this issue, the version 1.4.2 was released with an additional check in the affected function to prevent the usage of the `phar://` wrapper. However, because PHP wrappers are case-insensitive and the patch only checks the presence of the `phar://` string, it can be bypassed to achieve remote code execution again using a different case.
As for the initial vulnerability, PHP 7 or below is required for a successful exploitation using the deserialization of PHP archives metadata via the `phar://` wrapper.
## Technical
OSV
Snappy PHAR deserialization vulnerability
osv·2023-09-08·CVSS 9.8
CVE-2023-41330 [CRITICAL] Snappy PHAR deserialization vulnerability
Snappy PHAR deserialization vulnerability
## Issue
On March 17th the vulnerability [CVE-2023-28115 was disclosed](https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc), allowing an attacker to gain remote code execution through PHAR deserialization. To fix this issue, the version 1.4.2 was released with an additional check in the affected function to prevent the usage of the `phar://` wrapper. However, because PHP wrappers are case-insensitive and the patch only checks the presence of the `phar://` string, it can be bypassed to achieve remote code execution again using a different case.
As for the initial vulnerability, PHP 7 or below is required for a successful exploitation using the deserialization of PHP archives metadata via the `phar://` wrapper.
## Technical
OSV
PHAR deserialization allowing remote code execution
osv·2023-03-17
CVE-2023-28115 [CRITICAL] PHAR deserialization allowing remote code execution
PHAR deserialization allowing remote code execution
## Description
snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If user can control the output file from the `generateFromHtml()` function, it will invoke deserialization.
## Proof of Concept
Install Snappy via composer require `knplabs/knp-snappy`. After that, under snappy directory, create an `index.php` file with this vul
OSV
CVE-2023-28115: Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page
osv·2023-03-17·CVSS 9.8
CVE-2023-28115 [CRITICAL] CVE-2023-28115: Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page
Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromHtml()` function, it will invoke deserialization. This vulnerability is capable of remote code execution if Snappy is used with frameworks or developer
GHSA
PHAR deserialization allowing remote code execution
ghsa·2023-03-17
CVE-2023-28115 [CRITICAL] CWE-502 PHAR deserialization allowing remote code execution
PHAR deserialization allowing remote code execution
## Description
snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If user can control the output file from the `generateFromHtml()` function, it will invoke deserialization.
## Proof of Concept
Install Snappy via composer require `knplabs/knp-snappy`. After that, under snappy directory, create an `index.php` file with this vul
Debian
CVE-2023-28115: civicrm - Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a ur...
vendor_debian·2023·CVSS 9.8
CVE-2023-28115 [CRITICAL] CVE-2023-28115: civicrm - Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a ur...
Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromHtml()` function, it will invoke deserialization. This vulnerability is capable of remote code execution if Snappy is used with frameworks or developer
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/KnpLabs/snappy/blob/5126fb5b335ec929a226314d40cd8dad497c3d67/src/Knp/Snappy/AbstractGenerator.php#L670https://github.com/KnpLabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6https://github.com/KnpLabs/snappy/commit/b66f79334421c26d9c244427963fa2d92980b5d3https://github.com/KnpLabs/snappy/pull/469https://github.com/KnpLabs/snappy/releases/tag/v1.4.2https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggchttps://github.com/KnpLabs/snappy/blob/5126fb5b335ec929a226314d40cd8dad497c3d67/src/Knp/Snappy/AbstractGenerator.php#L670https://github.com/KnpLabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6https://github.com/KnpLabs/snappy/commit/b66f79334421c26d9c244427963fa2d92980b5d3https://github.com/KnpLabs/snappy/pull/469https://github.com/KnpLabs/snappy/releases/tag/v1.4.2https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc
2023-03-17
Published