Pontedilana

**Name of the Vulnerable Software and Affected Versions** PhpWeasyPrint versions prior to 2.6.0 **Description** PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The library fetches content of option values server-side using the `file get contents()` function when a value is identified as a URL, but it fails to restrict the URL scheme. Specifically, the `attachment` option of `Pdf` serves as the sink; any value validated by `isOptionUrl()` is downloaded by the PHP process and embedded into the resulting PDF. Since the validation allows schemes such as `http`, `https`, `ftp`, `file`, and PHP stream wrappers like `php://`, an attacker capable of influencing the `attachment` value can achieve Server-Side Request Forgery (SSRF)—allowing access to internal HTTP endpoints or cloud metadata—and local file disclosure via `file://` or `php://filter/...`, with the retrieved data exfiltrated as a PDF attachment. **Recommendations** Update to version 2.6.0. As a temporary workaround, restrict or avoid using the `attachment` option in the `Pdf` class until the update is applied.