CVE-2025-68616: WeasyPrint SSRF Protection Bypass via HTTP Redirect

Background

WeasyPrint is a popular open-source library used for generating PDF documents from HTML and CSS. It is widely utilized in web applications to create printable documents. The library allows developers to define custom URL fetching mechanisms to enhance security by validating or sanitizing URLs before fetching them. However, a critical vulnerability exists that undermines these security measures.

Vulnerability Detail

The vulnerability in WeasyPrint arises from its default URL fetching mechanism, which is susceptible to a Server-Side Request Forgery (SSRF) Protection Bypass. This occurs because the underlying urllib library automatically follows HTTP redirects without re-evaluating the new destination against the developer's security policies. An attacker can exploit this by providing a URL that initially passes validation but redirects to a blocked internal resource, leading to unauthorized access to sensitive internal services or cloud metadata endpoints.

pip install --upgrade "weasyprint==68.0"

Workaround

As a temporary workaround, developers can implement additional checks in their custom url_fetcher function to validate the final destination after a redirect. Here is an example of how to enhance the secure_fetcher function:

from weasyprint import default_url_fetcher

# Enhanced Security Filter

def secure_fetcher(url):
    # Check for both 'localhost' and any internal IP ranges
    if "localhost" in url or url.startswith("http://127."):
        raise PermissionError(f"Security Block: Access to {url} denied.")
    
    print(f"[ALLOWED] Initial URL check passed for: {url}")
    return default_url_fetcher(url)

Conclusion

The SSRF Protection Bypass vulnerability in WeasyPrint (CVE-2025-68616) poses significant risks to applications that rely on this library for PDF generation. It is crucial for developers to update to the patched version and consider implementing additional security measures to protect against potential exploits.

See every vulnerability recorded for weasyprint →

FAQ