CVE-2025-68616 — Open Redirect in Weasyprint

CWE-601 — Open RedirectCWE-918 — Server-Side Request Forgery8 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 81.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Kozea WeasyprintLexiforest Curl Cffi
Timeline
PublishedJan 19
Latest updateApr 3

Description

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-valid…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5kozea/weasyprint< 68.0
▶NVDkozea/weasyprint< 68.0
▶PyPIkozea/weasyprint< 68.0
▶PyPIlexiforest/curl_cffi< 0.15.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

5
OSV
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)↗2026-04-03
▶
GHSA
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)↗2026-04-03
▶
GHSA
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect↗2026-01-20
▶
OSV
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect↗2026-01-20
▶
CVEList
WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect↗2026-01-19
▶

📋Vendor Advisories

1
Red Hat
WeasyPrint: WeasyPrint Server-Side Request Forgery (SSRF)↗2026-01-19
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-68616 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-68616 — Open Redirect in Kozea Weasyprint | cvebase