GHSA-5g9f-cwwg-4p8g PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

• Packagist pontedilana/php-weasyprint: < 2.6.0 → fixed in 2.6.0

Summary `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown function — calls `unlink()` on every entry without verifying that the path is contained within the temporary folder. Any code holding a reference to a generator instance can push an arbitrary path into the array and have it deleted on script shutdown. This mirrors the KnpLabs/snappy issue GHSA-87qc-37cw-84h4, patched in snappy 1.7.2. Affected versions `pontedilana/php-weasyprint` versions `temporaryFiles as $file) { $this->unlink($file); } } ``` No path-containment check: whatever path is present in `$temporaryFiles` at shutdown is unlinked. Proof of concept ```php temporaryFiles[] = '/var/www/html/.env'; // On shutdown, removeTemporaryFiles() deletes /var/www/html/.env. ``` Impact • Arbitrary file deletion bound to script shutdown, scoped to the privileges of the PHP process user. • Not directly exploitable on its own (the attacker already needs to influence the property in the same request). The risk is amplification: chained with a separate disclosure bug it enables leak-then-delete-to-cover-tracks, and any deserialization/property-oriented gadget that reaches this property becomes a generic file-delete primitive. CWE-73 (External Control of File Name or Path). Suggested fix Only delete files that actually live inside the temporary folder, comparing canonical (`realpath`) paths: ```php public function removeTemporaryFiles(): void { $temporaryFolderPath = \realpath($this->getTemporaryFolder()); if (false === $temporaryFolderPath) { return; } $temporaryFolderPath = \rtrim($temporaryFolderPath, \DIRECTORY_SEPARATOR) . \DIRECTORY_SEPARATOR; foreach ($this->temporaryFiles as $file) { $filePath = \realpath($file); if (false === $filePath || 0 !== \strncmp($filePath, $temporaryFolderPath, \strlen($temporaryFolderPath))) { continue; } $this->unlink($file); } } ``` (The trailing directory separator prevents a sibling folder such as `/tmpevil` from matching `/tmp`; `strncmp` is used instead of `str_starts_with` to keep PHP 7.4 compatibility.) Credit Reported upstream to KnpLabs/snappy (GHSA-87qc-37cw-84h4); identified as applicable to `pontedilana/php-weasyprint`, which mirrors the same code.