WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

ImpactSince version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if urlfetcher is configured to prevent access to files and URLs. PatchesFixed by 734ee8e that’s included in 61.2 Workarounds- Check that no PDF attachment...