CVE-2026-110646: Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Windows deployments using Beganovich snappdf versions from 1.1.0 through versions before 6.1.0 are affected. The vulnerable path is executeOnWindows(), so the issue is specific to Windows.
What does an attacker need to exploit this?
An attacker must be able to influence the URL supplied to setUrl(). No authentication or user interaction is required according to the supplied vector, but exploitation has high attack complexity.
What is the impact of successful exploitation?
Injected cmd.exe metacharacters, such as &, can cause arbitrary commands to run through PHP exec(). Those commands execute with the privileges of the PHP process, affecting confidentiality, integrity, and availability.
What should be done if an update cannot be applied immediately?
Prevent untrusted input from reaching setUrl(), particularly values containing cmd.exe metacharacters. Restrict the PHP process account's permissions to limit the impact of command execution.