CVE-2026-55073
published 2026-09-14CVE-2026-55073: WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass…
PriorityP428medium6.2CVSS 3.1
AVLACLPRNUINSUCHINAN
EPSS
0.22%
12.5th percentile
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim. This issue is fixed in version 70.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| kozea | weasyprint | < 70.0 | 70.0 |
| kozea | weasyprint | >= 0 < 70.0 | 70.0 |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
weasyprint Has Server-Side Request Forgery (SSRF)
ghsa·2026-09-09
CVE-2026-55073 [MEDIUM] CWE-918 weasyprint Has Server-Side Request Forgery (SSRF)
weasyprint Has Server-Side Request Forgery (SSRF)
## Summary
`url_fetcher` is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block `file://`, internal hosts, etc. when rendering untrusted input.
Two `write_pdf()` channels ignore the document's `url_fetcher` and build a fresh default `URLFetcher()` instead. A restrictive fetcher set on `HTML()` is silently bypassed for:
- **`xmp_metadata=[url]`** - the URL is fetched and the bytes are embedded verbatim in the output PDF. This is an **arbitrary local file read** when the path is attacker-influenced.
- **`stylesheets=[url_or_path]`** - the sheet is fetched and applied. This is **SSRF / arbitrary local-or-internal resource loading**, and it is **transitive**: the permissive fetcher propagates th
VulDB
WeasyPrint up to 69.0 URL Fetch __init__.py write_pdf xmp_metadata/stylesheets server-side request forgery
vuldb·2026-09-09
CVE-2026-55073 [LOW] WeasyPrint up to 69.0 URL Fetch __init__.py write_pdf xmp_metadata/stylesheets server-side request forgery
A vulnerability was found in WeasyPrint up to 69.0. It has been declared as problematic. This affects the function write_pdf of the file weasyprint/pdf/__init__.py of the component URL Fetch. Such manipulation of the argument xmp_metadata/stylesheets leads to server-side request forgery.
This vulnerability is documented as CVE-2026-55073. The attack can be executed remotely. There is not any exploit available.
It is advisable to implement a patch to correct this issue.
Red Hat
weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass
vendor_redhat·2026-09-14·CVSS 6.2
CVE-2026-55073 [MEDIUM] CWE-1220 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass
weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass [epel-all]
bugzilla·2026-09-18·CVSS 6.2
CVE-2026-55073 [MEDIUM] CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass [epel-all]
CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the
Bugzilla
CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass [fedora-all]
bugzilla·2026-09-18·CVSS 6.2
CVE-2026-55073 [MEDIUM] CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass [fedora-all]
CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in t
Bugzilla
CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass
bugzilla·2026-09-14·CVSS 6.2
CVE-2026-55073 [MEDIUM] CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass
CVE-2026-55073 weasyprint: WeasyPrint: Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. T
2026-09-14
Published