p PatchFirst

CVE-2024-28184

CVE-2024-28184 · WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

CVSS 7.4 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • weasyprint

    Versions
    • >= 61.0, <= 61.1: Affected

    No fix published

  • weasyprint Debian:13

    Affected ranges
    • ECOSYSTEM: < 61.2-1

    Update to 61.2-1

  • weasyprint Debian:14

    Affected ranges
    • ECOSYSTEM: < 61.2-1

    Update to 61.2-1

  • weasyprint PyPI

    Versions
    • 61.0
    • 61.1
    Affected ranges
    • ECOSYSTEM: ≥ 61.0, < 61.2

    Update to 61.2

  • weasyprint Ubuntu:20.04:LTS

    Versions
    • 50-2
    • 51-1
    • 51-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:22.04:LTS

    Versions
    • 51-2
    • 51-3
    • 53.4-1
    • 54.0-1
    • 54.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:24.04:LTS

    Versions
    • 59.0-1
    • 60.2-1
    • 61.0-1
    • 61.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:25.10

    Versions
    • 62.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:26.10

    Versions
    • 67.0-1
    • 69.0-1
    • 69.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:26.04:LTS

    Versions
    • 62.3-1
    • 62.3-1build1
    • 67.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →