### Impact It impacts applications where: - the PHP daemon run with root permissions ; - the application is either running outside a container or has sensitive file access ; It could happens with this kind of workflows: ```php $stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’ $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $stylesheet ]); ``` ### Patches A list a schema with `http` and `https` by default is used to validate the remote path by default. ### Workarounds Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library. ```php // Bad example $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $_GET['input'], ]); ``` Instead developers can list available available stylesheets and pick the right one with the user input. ```php // Better $allowedStylesheets = [ 'invoice' => '/app/xsl/invoice.xsl', 'report' => '/app/xsl/report.xsl', ]; $key = $_GET['stylesheet'] ?? ''; if (!array_key_exists($key, $allowedStylesheets)) { throw new \RuntimeException('Unknown stylesheet.'); } $pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf'); $pdf->generate('page.html', 'out.pdf', [ 'xsl-style-sheet' => $allowedStylesheets[$key], ]); ``` ### References Read more about SSRF at [owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)
### Impact It impacts applications where: - the PHP daemon run with root permissions ; - the application is either running outside a container or has sensitive file access ; It could happens with this kind of workflows: ```php $stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’ $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $stylesheet ]); ``` ### Patches A list a schema with `http` and `https` by default is used to validate the remote path by default. ### Workarounds Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library. ```php // Bad example $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $_GET['input'], ]); ``` Instead developers can list available available stylesheets and pick the right one with the user input. ```php // Better $allowedStylesheets = [ 'invoice' => '/app/xsl/invoice.xsl', 'report' => '/app/xsl/report.xsl', ]; $key = $_GET['stylesheet'] ?? ''; if (!array_key_exists($key, $allowedStylesheets)) { throw new \RuntimeException('Unknown stylesheet.'); } $pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf'); $pdf->generate('page.html', 'out.pdf', [ 'xsl-style-sheet' => $allowedStylesheets[$key], ]); ``` ### References Read more about SSRF at [owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)
Update knplabs/knp-snappy to 1.7.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSnappy : SSRF and local file read via the xsl-style-sheet option affects knplabs/knp-snappy (composer). Severity is medium. ### Impact It impacts applications where: - the PHP daemon run with root permissions ; - the application is either running outside a container or has sensitive file access ; It could happens with this kind of workflows: ```php $stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’ $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $stylesheet ]); ``` ### Patches A list a schema with `http` and `https` by default is used to validate the remote path by default. ### Workarounds Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library. ```php // Bad example $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $_GET['input'], ]); ``` Instead developers can list available available stylesheets and pick the right one with the user input. ```php // Better $allowedStylesheets = [ 'invoice' => '/app/xsl/invoice.xsl', 'report' => '/app/xsl/report.xsl', ]; $key = $_GET['stylesheet'] ?? ''; if (!array_key_exists($key, $allowedStylesheets)) { throw new \RuntimeException('Unknown stylesheet.'); } $pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf'); $pdf->generate('page.html', 'out.pdf', [ 'xsl-style-sheet' => $allowedStylesheets[$key], ]); ``` ### References Read more about SSRF at [owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)
AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| knplabs/knp-snappycomposer | <=1.6.0 | 1.7.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate knplabs/knp-snappy to 1.7.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSnappy : SSRF and local file read via the xsl-style-sheet option affects knplabs/knp-snappy (composer). Severity is medium. ### Impact It impacts applications where: - the PHP daemon run with root permissions ; - the application is either running outside a container or has sensitive file access ; It could happens with this kind of workflows: ```php $stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’ $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $stylesheet ]); ``` ### Patches A list a schema with `http` and `https` by default is used to validate the remote path by default. ### Workarounds Developers should ensure usage cannot allow (in any case) a user to pass a free input directly to the Snappy library. ```php // Bad example $pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’); $pdf->generate(‘page.html’, ‘out.pdf’, [ ‘xsl-style-sheet’ => $_GET['input'], ]); ``` Instead developers can list available available stylesheets and pick the right one with the user input. ```php // Better $allowedStylesheets = [ 'invoice' => '/app/xsl/invoice.xsl', 'report' => '/app/xsl/report.xsl', ]; $key = $_GET['stylesheet'] ?? ''; if (!array_key_exists($key, $allowedStylesheets)) { throw new \RuntimeException('Unknown stylesheet.'); } $pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf'); $pdf->generate('page.html', 'out.pdf', [ 'xsl-style-sheet' => $allowedStylesheets[$key], ]); ``` ### References Read more about SSRF at [owasp.org/www-community/attacks/Server_Side_Request_Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)
AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| knplabs/knp-snappycomposer | <=1.6.0 | 1.7.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard