CVE-2026-110646
8.1 HIGHpublic exploit availablePublished 2026-10-14 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Public exploit & PoC references
All references
- https://github.com/beganovich/snappdf/blob/v6.0.0/src/Snappdf.php#L280-L284
- https://github.com/beganovich/snappdf/commit/5197bd3bcc4df44e17246dbceea9ce51eb390eae
- https://github.com/beganovich/snappdf/pull/54
- https://github.com/beganovich/snappdf/releases/tag/v6.1.0
- https://www.vulncheck.com/advisories/beganovich-snappdf-1.1.0-before-6.1.0-os-command-injection-on-windows-via-seturl
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2020-37279PoC
- CRITICALCVE-2020-37282PoC
- HIGHCVE-2022-51019PoC
- HIGHCVE-2025-14754
- CRITICALCVE-2025-71429PoC
- UNSCOREDCVE-2026-0313
- UNSCOREDCVE-2026-0320
- HIGHCVE-2026-100207
Related by shared AI tags and CWE weakness class. Browse the full archive.