Snappy : SSRF and local file read via the xsl-style-sheet option
Impact
It impacts applications where:
- the PHP daemon run with root permissions ;
- the application is either running outside a container or has sensitive file access ;
It could happens with this kind of workflows:
$stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
$pdf->generate(‘page.html’, ‘out.pdf’, [
‘xsl-style-sheet’ => $stylesheet
]);Patches
A list a schema with http and https by default is used to validate the remote path by default.
Workarounds
Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library.
// Bad example
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
$pdf->generate(‘page.html’, ‘out.pdf’, [
‘xsl-style-sheet’ => $_GET['input'],
]);Instead developers can list available available stylesheets and pick the right one with the user input.
// Better
$allowedStylesheets = [
'invoice' => '/app/xsl/invoice.xsl',
'report' => '/app/xsl/report.xsl',
];
$key = $_GET['stylesheet'] ?? '';
if (!array_key_exists($key, $allowedStylesheets)) {
throw new \RuntimeException('Unknown stylesheet.');
}
$pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf');
$pdf->generate('page.html', 'out.pdf', [
'xsl-style-sheet' => $allowedStylesheets[$key],
]);References
Read more about SSRF at owasp.org/www-community/attacks/Server_Side_Request_Forgery
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | knplabs/knp-snappy | < 1.7.0 | 1.7.0 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N- Weakness (CWE)
CWE-918- Platform
- Composer
- Package
knplabs/knp-snappy- Disclosed
- 21.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-c5fp-p67m-gq56 - CC BY 4.0
Vulnerability history: knplabs/knp-snappy
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 03.2023 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
- Medium 1
Disclosures per year
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 2
-
Snappy : SSRF and local file read via the xsl-style-sheet option this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.