CVE-2026-55073

A flaw was found in WeasyPrint. Server-side applications that configure a restrictive URL fetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. This allows an attacker to read local files or perform Server-Si...

CVE-2026-55073

WeasyPrint prior to 70.0 contains a url_fetcher bypass in two write_pdf() code paths. The xmp_metadata parameter in weasyprint/pdf/__init__.py calls select_source() without passing the document's fetcher, enabling arbitrary local file read with contents embedded verbatim in the output PDF. The st...

CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...