Executive Summary

The CVE-2026-46683 vulnerability affects the KnpLabs/snappy PHP library versions up to 1.6.0. It allows Server-Side Request Forgery (SSRF) and local file read attacks via the `xsl-style-sheet` option. This happens when user-controlled input is passed directly to the library, enabling attackers to read sensitive files or make unauthorized requests.

The issue was patched in version 1.7.0 by adding a default schema validation that restricts remote paths to HTTP and HTTPS only.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to perform unauthorized requests from the server (SSRF) or read local files on the server where the Snappy library is used. This can lead to exposure of sensitive information, unauthorized access to internal resources, and potential further exploitation of the affected system.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves the use of the xsl-style-sheet option in the Snappy PHP library, which can be exploited via user-controlled input to perform SSRF or local file reads.

To detect this vulnerability, you should check if your application uses Snappy versions up to 1.6.0 and if it passes user input directly to the xsl-style-sheet option.

There are no specific commands provided in the resources, but general detection steps include:

• Review application code for usage of the xsl-style-sheet option with user input.
• Monitor network traffic for unusual outbound requests initiated by the application that could indicate SSRF attempts.
• Use web application security scanners or custom scripts to test if the xsl-style-sheet option can be manipulated to access local files or external URLs.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade the Snappy library to version 1.7.0 or later, where the vulnerability has been patched.

Additionally, avoid passing direct user input to the xsl-style-sheet option. Instead, use predefined stylesheet paths to prevent exploitation.

Ensure that remote paths are restricted to HTTP and HTTPS schemas as enforced in the patched version.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-46683 vulnerability allows attackers to perform Server-Side Request Forgery (SSRF) and read local files via the xsl-style-sheet option in the KnpLabs/snappy library. This can lead to unauthorized access to sensitive files or data.

Such unauthorized access to sensitive information could potentially lead to violations of data protection regulations like GDPR or HIPAA, which require strict controls over personal and sensitive data to prevent unauthorized disclosure.

Mitigating this vulnerability by upgrading to version 1.7.0 or later, which includes schema validation restricting remote paths and avoiding user-controlled input, is essential to maintain compliance with these standards.

Useful 0 Not Useful 0