p PatchFirst

CVE-2025-68616

CVE-2025-68616 · WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • weasyprint

    Versions
    • < 68.0: Affected

    No fix published

  • weasyprint Debian:12

    Versions
    • 57.2-1
    • 59.0-1
    • 60.2-1
    • 61.0-1
    • 61.1-1
    • 61.2-1
    • 61.2-2
    • 62.0-1
    • 62.1-1
    • 62.2-1
    • 62.3-1
    • 67.0-1
    • 69.0-1
    • 69.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Debian:13

    Versions
    • 62.3-1
    • 67.0-1
    • 69.0-1
    • 69.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Debian:14

    Versions
    • 62.3-1
    • 67.0-1
    Affected ranges
    • ECOSYSTEM: < 69.0-1

    Update to 69.0-1

  • weasyprint PyPI

    Versions
    • 0.1
    • 0.10
    • 0.11
    • 0.12
    • 0.13
    • 0.14
    • 0.15
    • 0.16
    • 0.17
    • 0.17.1
    • 0.18
    • 0.19
    • 0.19.1
    • 0.19.2
    • 0.2
    • 0.2.1
    • 0.2.2
    • 0.20
    • 0.20.1
    • 0.20.2
    • 0.21
    • 0.22
    • 0.23
    • 0.24
    • 0.25
    • 0.26
    • 0.27
    • 0.28
    • 0.29
    • 0.3
    • 0.3.1
    • 0.30
    • 0.31
    • 0.32
    • 0.33
    • 0.34
    • 0.35
    • 0.36
    • 0.37
    • 0.38
    • 0.39
    • 0.4
    • 0.40
    • 0.41
    • 0.42
    • 0.42.1
    • 0.42.2
    • 0.42.3
    • 0.5
    • 0.6
    • 0.6.1
    • 0.7
    • 0.7.1
    • 0.8
    • 0.9
    • 43
    • 43rc1
    • 43rc2
    • 44
    • 45
    • 46
    • 47
    • 48
    • 49
    • 50
    • 51
    • 52
    • 52.1
    • 52.2
    • 52.3
    • 52.4
    • 52.5
    • 53.0
    • 53.0b1
    • 53.0b2
    • 53.1
    • 53.2
    • 53.3
    • 53.4
    • 54.0
    • 54.0b1
    • 54.1
    • 54.2
    • 54.3
    • 55.0
    • 55.0b1
    • 56.0
    • 56.0b1
    • 56.1
    • 57.0
    • 57.0b1
    • 57.1
    • 57.2
    • 58.0
    • 58.0b1
    • 58.1
    • 59.0
    • 59.0b1
    • 60.0
    • 60.1
    • 60.2
    • 61.0
    • 61.1
    • 61.2
    • 62.0
    • 62.1
    • 62.2
    • 62.3
    • 63.0
    • 63.1
    • 64.0
    • 64.1
    • 65.0
    • 65.1
    • 66.0
    • 67.0
    Affected ranges
    • ECOSYSTEM: < 68.0

    Update to 68.0

  • weasyprint Ubuntu:20.04:LTS

    Versions
    • 50-2
    • 51-1
    • 51-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:22.04:LTS

    Versions
    • 51-2
    • 51-3
    • 53.4-1
    • 54.0-1
    • 54.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:24.04:LTS

    Versions
    • 59.0-1
    • 60.2-1
    • 61.0-1
    • 61.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:25.10

    Versions
    • 62.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:26.10

    Versions
    • 67.0-1
    • 69.0-1
    • 69.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:26.04:LTS

    Versions
    • 62.3-1
    • 62.3-1build1
    • 67.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →