AIKIDO-2026-10857
knplabs/knp-snappy is vulnerable to Arbitrary File Deletion
38
Low Risk
This Affects:
knplabs/knp-snappyTL;DR
AbstractGenerator stores temporary cleanup paths in a public $temporaryFiles array and unlinks each entry during cleanup. Code that can modify a Snappy generator instance can add paths outside the temporary directory and cause arbitrary files to be deleted at shutdown. This can turn another bug, such as object injection or access to the generator object, into a file deletion primitive. The fix resolves paths and only deletes files that are inside the configured temporary directory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
knplabs/knp-snappy is vulnerable to Arbitrary File Deletion in versions 0.1.0 - 1.7.1.
How to fix this
Upgrade the knplabs/knp-snappy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant