CVE-2026-55073
Received Received - Intake

Path Traversal in WeasyPrint PDF Generation

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim. This issue is fixed in version 70.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-55073
EUVD
EUVD-2026-77638

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
weasyprint weasyprint 70.0
kozea weasyprint 70.0
kozea weasyprint to 69.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55073 is a Server-Side Request Forgery (SSRF) vulnerability in WeasyPrint, a Python library for converting HTML to PDF. It affects versions up to 69.0. The issue occurs when the write_pdf() function uses xmp_metadata or stylesheets parameters. These functions ignore the document's configured url_fetcher and use a default permissive fetcher instead. This allows attackers to bypass restrictions and read local files or access internal resources.

Detection Guidance

Check WeasyPrint version with pip show weasyprint. If version is below 70.0, the system is vulnerable. Review server-side applications using write_pdf() with xmp_metadata or stylesheets parameters for improper url_fetcher usage.

Impact Analysis

This vulnerability allows attackers to read arbitrary files accessible to the rendering process and embed their contents in generated PDFs. For stylesheets, it enables SSRF or loading of arbitrary local/internal resources, which can propagate through CSS imports. Applications using WeasyPrint server-side with a restrictive url_fetcher are at risk if attacker-controlled URLs or paths are passed to these parameters.

Compliance Impact

This vulnerability could lead to unauthorized access to local or internal files, which may contain sensitive personal or health data. For GDPR, this could result in unauthorized processing of personal data, violating principles of lawfulness and data minimization. For HIPAA, it risks exposing protected health information, leading to compliance breaches and potential data breaches.

Mitigation Strategies

Upgrade WeasyPrint to version 70.0 or later immediately. Ensure all calls to write_pdf() pass the document's url_fetcher to xmp_metadata and stylesheets parameters. Review and restrict access to local/internal resources in server-side configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55073. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart