CVE-2026-55073 Details
Description
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim. This issue is fixed in version 70.0.
A server-side request forgery (SSRF) vulnerability has been identified in WeasyPrint versions prior to 70.0. This issue allows arbitrary local file reading by bypassing restrictions set by the application's URL fetcher. The vulnerability arises in the PDF generation process when attacker-controlled values are passed to the 'xmp_metadata' or 'stylesheets' options. In both cases, the default URL fetcher is used, which can access local files and internal resources, propagating the permissive fetcher through nested CSS imports and URL references. This vulnerability affects applications that use WeasyPrint to render untrusted input and rely on the URL fetcher to block access to local files or internal hosts.
Users are advised to upgrade WeasyPrint to version 70.0 or later, and to avoid rendering untrusted images or relying on the URL fetcher to filter metadata or stylesheets.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jf6q-chmf-3h3v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Kozea/WeasyPrint/commit/289e278439b017cd9263b4cd4727026987f86443 | [email protected] | Source CodeVendor |
| https://github.com/Kozea/WeasyPrint/releases/tag/v70.0 | [email protected] | Release NotesVendor |
| https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jf6q-chmf-3h3v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WeasyPrint | <= 69.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |