CVE-2026-55073: WeasyPrint Server-Side Request Forgery (SSRF) Vulnerability
Summary
CVE-2026-55073: weasyprint Has Server-Side Request Forgery (SSRF). Affects weasyprint versions < 70.0. Fixed in 70.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WeasyPrint is a popular open-source library for generating PDF documents from HTML and CSS. It is widely used in web applications to create reports, invoices, and other documents dynamically. The library provides a mechanism called 'url_fetcher' to control resource loading, allowing developers to restrict access to certain URLs, such as local files or internal network resources. However, a vulnerability has been identified that allows an attacker to bypass these restrictions under specific conditions, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the improper handling of the 'url_fetcher' parameter in two specific functions: 'write_pdf(xmp_metadata=[...])' and 'write_pdf(stylesheets=[str])'. In these cases, the library defaults to a fresh instance of URLFetcher, ignoring any restrictive settings that the application may have configured. This flaw allows an attacker to exploit the 'xmp_metadata' and 'stylesheets' parameters to read arbitrary local files or load internal resources, leading to potential data leakage and unauthorized access to sensitive information.
How To Fix
Latest published version: 70.0.0 as of 23 Oct 2026
pip install --upgrade "weasyprint==70.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
70.0
This is the first release that contains the fix.
pip install --upgrade "weasyprint==70.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a custom URLFetcher that blocks access to local files and internal resources. Here is an example of how to create a blocking URLFetcher:
import os
from weasyprint.urls import URLFetcher
class Block(URLFetcher):
def fetch(self, url, headers=None):
if url.lower().startswith('file:'):
raise ValueError('blocked ' + url)
return super().fetch(url, headers)
Use this custom fetcher when calling WeasyPrint functions to ensure that local file access is restricted.
Conclusion
The CVE-2026-55073 vulnerability in WeasyPrint poses a significant risk by allowing SSRF attacks that can lead to unauthorized access to local files and internal resources. It is crucial to update to the latest version of WeasyPrint to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for weasyprint →
FAQ
CVE-2026-55073 is a vulnerability in WeasyPrint that allows for Server-Side Request Forgery (SSRF), enabling attackers to bypass restrictions on resource loading.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without signup.
The risks include unauthorized access to sensitive local files and internal resources, which could lead to data leakage and potential exploitation of the application.
You can update WeasyPrint to the patched version by running the command 'pip install --upgrade weasyprint' in your terminal.
If immediate updating is not possible, implement a custom URLFetcher to block access to local files as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for weasyprint.
