External risk intelligence

Beganovich snappdf OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-110646

The vulnerability resides in the snappdf PHP library. Reachability depends on whether a host application passes user-controlled input to the setUrl() function. While not a public-facing service itself, it is plausibly reachable if integrated into web deployments that handle external URL input.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the snappdf library, specifically affecting Windows environments, could allow attackers to execute commands by manipulating rendered URLs. This occurs when user-controlled input is passed unescaped to a system command execution function. The main concern is confirming whether this library is in use and if user-controlled data is processed in a way that could trigger this vulnerability.

Remote command execution through a vulnerable library.
Business impact hinges on library use and data input.
Confirm relevance and exposure of this library.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a Windows system by sending specially crafted URLs to a vulnerable application that uses the snappdf library. This input, when processed by the `setUrl()` function and passed to the `exec()` function without proper sanitization, allows the attacker to inject operating system commands that are then executed with the privileges of the PHP process.

User-controlled input influencing a URL.
Vulnerable `setUrl()` function processing URL.
Risk of unauthorized command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands on Windows systems when the snappdf library processes a specially crafted URL. This occurs because user-controlled input in the `setUrl()` function is not properly escaped before being passed to the `exec()` function, leading to the execution of commands as the PHP process.

Server-side commands could be executed.
Malicious input in a URL could trigger execution.
System compromise is a potential consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Beganovich snappdf library's OS command injection vulnerability requires identifying which applications utilize the affected component and then determining their exposure to user-influenced URLs. Application owners and platform teams are likely responsible for assessing their deployments and planning remediation, which may involve coordinating with vendors or implementing temporary controls if immediate patching is not feasible.

Application owners and platform teams.
Verify affected component usage and URL input.
Plan remediation or implement compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Beganovich snappdf?

Beganovich snappdf is a PHP library used by developers to convert web pages into PDF documents. It acts as a wrapper around the Chromium-based PDF rendering engine. Applications use it to generate reports, invoices, or other documents from HTML content by specifying a URL or local file for the library to process.

What is the vulnerability in CVE-2026-110646?

This CVE involves an OS command injection, which is classified as CWE-78. The weakness occurs when an application fails to properly clean or sanitize input. In this case, the library allows special characters in a URL string to be passed directly to the operating system's command processor, letting unintended commands run with the privileges of the PHP application.

How can an attacker trigger this vulnerability?

An attacker triggers this by providing a malicious URL containing specific command-line metacharacters, such as the ampersand symbol, to an application using this library. The vulnerability only exists on Windows systems where the library's `setUrl()` function fails to escape these characters before they reach the system's execution function. It does not trigger if the input is hardcoded or comes from a trusted internal source.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal classifies this as a possible risk. While snappdf is a library rather than a standalone service, it becomes a concern if your specific application uses it to process untrusted or user-supplied URLs. If your web application takes input from external users and passes it to the `setUrl()` function, the library's internal flaw could be exposed.

How do I address this CVE-2026-110646 vulnerability?

The primary step is to audit your environment to identify any applications relying on versions of snappdf prior to 6.1.0. If usage is confirmed, update the library to version 6.1.0 or later to receive the necessary security fixes. If immediate patching is not possible, work with your development team to restrict the types of inputs permitted by functions that call the library.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.