Summary
Snappy: Binary path is never shell-escaped due to an inverted is_executable check
Proof of concept:
$pdf = new Knp\Snappy\Pdf(‘wkhtmltopdf; touch /tmp/snappy_rce’);
$pdf->generate(‘https://example.com’, ‘/tmp/out.pdf’);
// /tmp/snappy_rce is created.
Impact: command execution as the PHP process when the binary path is attacker-influenced. Even in deployments where the binary is hard-coded, this is a defensive-in-depth regression: downstream packages reasonably assume Snappy shell-escapes the binary because the code looks like it does.
Workarounds
Before calling the constructor, ensure \is_executable($path) is truthy.
// Bad example
$pdf = new Knp\Snappy\Pdf('/path/to/binary');
// Better example
$pathToBinary = '/path/to/binary';
if (!\is_executable($pathToBinary)) {
throw new \RuntimeException();
}
$pdf = new Knp\Snappy\Pdf('/path/to/binary');
Impact
On POSIX, escapeshellarg(‘/usr/bin/wkhtmltopdf’) returns the literal string ‘/usr/bin/wkhtmltopdf’ with the single-quote characters included. is_executable() then looks for a file whose actual name contains those quote characters, which essentially never exists. The safe branch is dead code and $command always falls through to the raw, unescaped value.
The rest of the arguments (options, input, output) are escaped correctly, so injection has to land in the binary string itself. That happens whenever the binary path is sourced from configuration that is user-influenced, derived from environment variables that ultimately come from request data, or concatenated with any user-controlled fragment.
Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The version 1.7.1 will resolve this security advisory.
Frequently Asked Questions
- What is CVE-2026-46643? CVE-2026-46643 is a high-severity OS command injection vulnerability in KnpLabs/knp-snappy (composer), affecting versions <= 1.7.0. It is fixed in 1.7.1. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
- Which versions of KnpLabs/knp-snappy are affected by CVE-2026-46643? KnpLabs/knp-snappy (composer) versions <= 1.7.0 is affected.
- Is there a fix for CVE-2026-46643? Yes. CVE-2026-46643 is fixed in 1.7.1. Upgrade to this version or later.
- Is CVE-2026-46643 exploitable, and should I be worried? Whether CVE-2026-46643 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-46643 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-46643? Upgrade
KnpLabs/knp-snappyto 1.7.1 or later.