PhpWeasyPrint is a PHP library that generates PDFs from URLs or HTML. In versions older than 2.6.0, the public array AbstractGenerator::$temporaryFiles can be appended with arbitrary paths. When the object is destroyed or the registered shutdown function runs, the framework calls unlink() on every entry without verifying that the file resides in the temporary directory. An attacker who can influence the contents of the array can therefore cause critical files to be deleted when the script terminates, leading to inadvertent data loss or service disruption. This vulnerability represents an integrity compromise rather than remote code execution, but its impact is potentially damaging if sensitive files are targeted.

The affected product is PhpWeasyPrint from the vendor pontedilana. All releases before version 2.6.0 are vulnerable. The patch that removes the vulnerability was included in the 2.6.0 release, as referenced in the official changelog and commit record.

The CVSS score is 3, indicating low severity, and no EPSS value is currently available. The vulnerability is not listed in the CISA KEV catalog. An exploit requires the ability to manipulate the generator instance at runtime, which typically implies local code execution or injection into the script. There is no publicly documented remote exploitation mechanism, so the practical risk to remote attackers is limited, but an insider or compromised script could trigger the deletion on shutdown.