Vulnerability details

CVE-2026-110646

beganovich snappdf

Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()

CVSS 4.0

9.2Critical

Official description

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.

CVSS scores

Score	Version	Source	Vector
9.2Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
8.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
beganovich	snappdf	1.1.0 ≤ v < 6.1.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/beganovich/snappdf/pull/54 patchissue-tracking
https://github.com/beganovich/snappdf/commit/5197bd3bcc4df44e17246dbceea9ce51eb390eae patch
https://github.com/beganovich/snappdf/blob/v6.0.0/src/Snappdf.php#L280-L284 technical-description
https://github.com/beganovich/snappdf/releases/tag/v6.1.0 release-notes
https://www.vulncheck.com/advisories/beganovich-snappdf-1.1.0-before-6.1.0-os-command-injection-on-windows-via-seturl third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-14
Last updated: 2026-10-20
State: Published
Assigner (CNA): VulnCheck
Kolun priority: 34 · Low

Exploit prediction (EPSS)

2.11%

Probability of exploitation in 30 days

81.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')