CVE-2026-110646 is a High severity (CVSS 8.1) OS command injection in beganovich snappdf from 1.1.0 before 6.1.0, on Windows. A URL containing cmd.exe characters can run commands as the PHP process. Upgrade to snappdf 6.1.0, the release that fixes it.
What's affected
The record says snappdf from 1.1.0 before 6.1.0 is affected, and only on Windows. The project's v6.1.0 release is the fix. Its release note says, in its own words, that it fixes command injection on Windows where unescaped argv was passed to exec.
The weakness is CWE-78, OS command injection. Per the record, the Windows code path builds a command line and passes it to the PHP exec function without escaping. A value given to setUrl that contains characters such as an ampersand is read by cmd.exe as a command separator.
The risk depends on whether anyone outside your team can influence the URL you render. Severity differs by source. The record gives 8.1 (High), with high attack complexity. VulnCheck lists 9.2 (Critical) on a CVSS 4.0 vector. Our title follows the record.
How to check if you're exposed
Check whether you use snappdf and which version.
composer show beganovich/snappdf
Versions from 1.1.0 up to, but not including, 6.1.0 are in range. The flaw is on the Windows code path, so Linux and macOS servers are not affected by this CVE. If your server runs on Windows, such as IIS or a Windows container, check how URLs reach setUrl.
Look in your code for places where the URL passed to the library comes from a request, a form field, a stored record or an imported file. An internal job that renders a fixed list of pages is a much smaller concern. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Upgrade to snappdf 6.1.0 or later with Composer and redeploy.
- Validate URLs before rendering. Accept only http and https, check the host against an allow list, and reject anything with shell metacharacters.
- Run the PHP process with a low privilege account that cannot reach secrets or write outside its own folders.
- If you cannot upgrade yet, do not render untrusted URLs on Windows servers.
- Review web server and process logs for unusual child processes started by PHP.
Why it matters
Libraries that wrap a command line tool often build one string for the shell. On Windows, cmd.exe has its own set of special characters, and code written with Unix shells in mind can miss them. The fix is to escape every argument for the target shell, or to avoid the shell and start the program directly.
PDF and screenshot generators are frequently given URLs from users, which makes this class of flaw easy to reach in real applications. When a library is in your dependency tree because of a feature like invoice export, a version check is cheap insurance. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect Linux servers?
The record describes it as an issue on Windows. The affected code path is the one used for Windows.
What is the fixed version?
snappdf 6.1.0, per the project's release note.
Sources
Last reviewed: 18 October 2026.
