CVE-2026-110646Published
Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110646 · Microsoft / collected KEV context
cve-program · CVE-2026-110646
- https://github.com/beganovich/snappdf/pull/54
- https://github.com/beganovich/snappdf/commit/5197bd3bcc4df44e17246dbceea9ce51eb390eae
- https://github.com/beganovich/snappdf/blob/v6.0.0/src/Snappdf.php#L280-L284
- https://github.com/beganovich/snappdf/releases/tag/v6.1.0
- https://www.vulncheck.com/advisories/beganovich-snappdf-1.1.0-before-6.1.0-os-command-injection-on-windows-via-seturl
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.