CVE-2026-55073: WeasyPrint SSRF Vulnerability Allows Arbitrary Resource Loading
Summary
CVE-2026-55073: weasyprint Has Server-Side Request Forgery (SSRF). Affects weasyprint versions < 70.0. Fixed in 70.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WeasyPrint is a popular open-source library for generating PDF documents from HTML and CSS. It is widely used in web applications to create reports, invoices, and other documents. The library provides a mechanism for controlling resource loading through a feature called 'url_fetcher', which is intended to prevent unauthorized access to local files and internal resources. However, a critical vulnerability has been identified that allows attackers to bypass these restrictions.
Vulnerability Detail
The vulnerability arises from the improper handling of the 'url_fetcher' parameter in the 'write_pdf()' function of WeasyPrint. Specifically, two channels, 'xmp_metadata' and 'stylesheets', do not respect the configured 'url_fetcher' and instead use a default, permissive fetcher. This oversight allows an attacker to exploit the library by providing a malicious URL or file path, leading to Server-Side Request Forgery (SSRF) and arbitrary local file reads. The consequences can be severe, as attackers can access sensitive files on the server, including configuration files and credentials.
How To Fix
Latest published version: 70.0.0 as of 23 Oct 2026
pip install --upgrade "weasyprint==70.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
70.0
This is the first release that contains the fix.
pip install --upgrade "weasyprint==70.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update WeasyPrint, consider implementing a custom 'url_fetcher' that strictly controls access to resources. Below is an example of a blocking fetcher that raises an error for any file URLs:
class Block(URLFetcher):
def fetch(self, url, headers=None):
if url.lower().startswith('file:'):
raise ValueError('blocked ' + url)
return super().fetch(url, headers)
Conclusion
The WeasyPrint SSRF vulnerability (CVE-2026-55073) poses a significant risk to applications using the library for PDF generation. It is crucial to update to the patched version or implement workarounds to mitigate the risks associated with this vulnerability. Regular monitoring for vulnerabilities is essential, and tools like Vulert can assist in maintaining security.
See every vulnerability recorded for weasyprint →
FAQ
The vulnerability allows attackers to bypass resource loading restrictions, leading to SSRF and arbitrary file reads.
All versions up to and including 69.0 are affected. Version 70.0 and later contain the fix.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to sensitive files, potential data leaks, and exploitation of internal resources.
Yes, you can implement a custom URL fetcher that blocks access to file URLs as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for weasyprint.
