azure linux snappy vulnerabilities

Latest azure linux snappy CVEs

Newest publication first

1. CVE-2026-46683 Snappy: SSRF and local file read via the xsl-style-sheet option

   Published 2026-06-10

   Medium·CVSS 6.9 EPSS 0.25%

   Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.7.0, there is a SSRF and local file read vulnerability via the xsl-style-sheet option. This issue has been patched in version 1.7.0.

2. CVE-2026-46643 Snappy: Binary path is never shell-escaped due to an inverted is_executable check

   Published 2026-06-10

   High·CVSS 7.5 EPSS 0.20%

   Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.7.1, on POSIX, escapeshellarg(‘/usr/bin/wkhtmltopdf’) returns the literal string ‘/usr/bin/wkhtmltopdf’ with the single-quote characters included. is_executable()...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.