CVE-2026-110646

8.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Remote attackers can execute arbitrary OS commands with the privileges of the PHP process on Windows hosts. They need the ability to control or influence the URL value passed to setUrl().

Root cause

The executeOnWindows() method passes the setUrl() value to PHP's exec() without escaping cmd.exe metacharacters.

Affected systems

Beganovich snappdf 1.1.0 before 6.1.0 on Windows

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade beganovich/snappdf to version 6.1.0 or later. If patching immediately is not possible, sanitize or validate URLs passed to setUrl() to reject cmd.exe metacharacters like '&', or host the application on Linux where executeOnWindows() is not invoked.

shell

$ composer require beganovich/snappdf:^6.1.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110646