CVE-2025-68616High· 7.5▾ MidnightPoC availableWeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal ne…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
1 GitHub repo
0.5% → 0.7%
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's default_url_fetcher. The vulnerability allows attackers to access internal network resources (such as localhost services or cloud metadata endpoints) even when a developer has implemented a custom url_fetcher to block such access. This occurs because the underlying urllib library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
weasyprint < 68.0Upgrade past the affected range:
weasyprint 68.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55073Medium· 6.2WeasyPrint helps web developers to create PDF documents
CVE-2026-59806High· 7.4Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch…
CVE-2026-106443High· 8.8WeasyPrint helps web developers to create PDF documents
CVE-2026-101907High· 7.0Axios is a promise-based HTTP client for the browser and Node.js
CVE-2024-28184High· 7.4WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
CVE-2026-49452Medium· 6.5WeasyPrint helps web developers to create PDF documents