PT-2026-89206
CVE-2026-55073
·
Published
2026-09-09
·
Updated
2026-09-21
Description by
CVSS 3.1
6.2
MediumMetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
WeasyPrint versions prior to 70.0
Description
Server-side applications using WeasyPrint to render untrusted input may experience a bypass of the
url fetcher mechanism, which is designed to restrict resource loading (such as blocking file:// or internal hosts). This occurs when attacker-influenced values are passed to the HTML.write pdf() function through two specific options:- The
xmp metadataoption calls theselect source()function without the document'surl fetcher, enabling an arbitrary local file read where the file contents are embedded verbatim in the resulting PDF. - The
stylesheetsoption constructsCSS()without the document'surl fetcher, allowing Server-Side Request Forgery (SSRF) and the loading of local or internal resources. This effect is transitive, as the permissive fetcher propagates through nested CSS imports andurl()references.
Recommendations
Update WeasyPrint to version 70.0.
As a temporary mitigation, avoid passing attacker-influenced values to the
xmp metadata and stylesheets parameters in the write pdf() function. Found an issue in the description? Have something to add? Feel free to write us 👾