CVE-2026-110646 in snappdf
Summary
by MITRE • 10/14/2026
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The security flaw identified in Beganovich Snappdf versions ranging from 1.1.0 up to but not including version 6.1.0 represents a critical server-side vulnerability classified under Operating System Command Injection. This issue specifically affects deployments running on Windows operating systems and stems from improper neutralization of special elements used in an operating system command, commonly referred to as CWE-78. The root cause lies within the internal logic that handles URL processing for PDF generation tasks. When a user or external actor provides input intended to define the source document via the setUrl() method, the application fails to adequately sanitize this input before passing it to underlying system utilities.
The technical mechanism of exploitation involves the interaction between PHP's exec function and Windows command interpreters. The vulnerable code path utilizes an internal function named executeOnWindows(), which is responsible for invoking external processes required by Snappdf to convert web content into PDF format. This function accepts a URL string provided through setUrl() and passes it directly, without escaping or validation of metacharacters, to PHP's exec() function. On Windows systems, the command shell interprets specific characters such as ampersands (&) as logical operators that separate commands. Consequently, if an attacker supplies a crafted URL containing these special characters, they can effectively append arbitrary operating system commands to the legitimate PDF generation process.
The operational impact of this vulnerability is severe, granting attackers the ability to execute arbitrary code with the same privileges as the PHP web server process. This level of access typically corresponds to high-privilege accounts such as IUSR or ApplicationPoolIdentity on Windows servers, which often possess significant permissions within the local system environment. Successful exploitation allows for remote command execution without authentication in many configurations, enabling attackers to read sensitive files, modify application data, install malware, or pivot further into the internal network infrastructure. This aligns with the MITRE ATT&CK technique of Command and Scripting Interpreter, specifically noting how adversaries leverage native tools like cmd.exe to achieve persistence and control over compromised systems.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators should upgrade Snappdf to version 6.1.0 or later, where the developers have addressed this input validation deficiency by implementing proper escaping mechanisms for shell metacharacters before execution. In scenarios where an immediate update is not feasible due to dependency constraints, temporary mitigations include enforcing strict allowlisting of acceptable URL patterns at the application layer and ensuring that the web server process runs with minimal privileges restricted only to necessary file system operations. Additionally, deploying a Web Application Firewall may help detect and block requests containing suspicious command injection payloads before they reach the vulnerable PHP code path.