An OS command injection flaw exists in the Beganovich snappdf library between versions 1.1.0 and 6.0.x. A Windows environment that runs the PHP process can inject cmd.exe metacharacters – such as ampersand – into the URL supplied to setUrl(). The vulnerability causes executeOnescaped string directly to PHP's exec() call, allowing an attacker to execute arbitrary commands with the privileges of the PHP interpreter.

The flaw affects the Beganovich snappdf product, particularly release series 1.1.0 through 6.0.x. The affected configurations are those running the library on Windows operating systems, where setUrl() is invoked with externally supplied data.

The CVSS score of 9.2 marks this as a critical vulnerability. The EPSS score of 2% indicates a low but nonzero probability of exploitation. The lack of a KEV listing does not diminish exploitability; the path to exploitation is straightforward: an attacker crafts a malicious URL, submits it to an application using snappdf, and the injected command runs under the PHP process. Successful exploitation would grant untrusted code execution on the vulnerable system.