Description

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim. This issue is fixed in version 70.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-09-14T17:17:47.770Z",
  "pubdate": "2026-09-14T17:17:47.770Z",
  "executiveSummary": "WeasyPrint prior to version 70.0 is susceptible to a security bypass vulnerability that undermines restrictive URL fetcher configurations.\nThe vulnerability originates from the improper handling of resource loading mechanisms within the HTML.write_pdf() pipeline.\nBy manipulating the xmp_metadata or stylesheets options, an attacker can circumvent defined fetcher restrictions, facilitating unauthorized access to local files and internal network resources.\nThe impact includes potential information disclosure, as local files can be embedded directly into generated PDF documents.\nThis issue is particularly relevant in server-side applications where user-controlled input influences PDF generation parameters, potentially exposing sensitive system files or restricted internal assets that the application's global policy intended to protect.\nExploitation requires an attacker to successfully inject malicious values into the document generation process, which is facilitated by the application's failure to propagate the configured restrictive fetcher to all internal resource retrieval components.",
  "technicalDetails": "The vulnerability resides in the insufficient enforcement of the document-wide URL fetcher policy within key components of the WeasyPrint library, specifically in weasyprint/pdf/init.py and weasyprint/document.py.\nIn weasyprint/pdf/init.py, the xmp_metadata handling process invokes select_source() without integrating the document's configured URL fetcher. This omission allows the function to default to standard system-level resource resolution, enabling an attacker to specify local file paths. Consequently, the library reads these arbitrary local files and embeds their contents verbatim into the XMP metadata of the resulting PDF document, leading to unauthorized local file disclosure.\nIn weasyprint/document.py, the initialization of stylesheets via the CSS() function similarly fails to utilize the document's defined url_fetcher. This results in the instantiation of a permissive fetcher for stylesheet loading. This failure is compounded by the propagation of this permissive fetcher through nested CSS imports and subsequent url() references within the stylesheets. While the stylesheets channel itself does not disclose content verbatim as the XMP metadata vector does, it allows for the loading of restricted internal or local resources, potentially facilitating further network-based attacks or resource mapping.\nThe attack flow entails the following: An attacker supplies a crafted input containing malicious references to internal or local resources via the xmp_metadata or stylesheets parameters in a call to HTML.write_pdf(). Because the library fails to pass the application-defined restrictive fetcher through these specific channels, the internal components utilize default resolution logic. In the case of xmp_metadata, the content is fetched and embedded directly into the output document. In the case of stylesheets, the application is forced to fetch and process external or internal CSS files that should otherwise be blocked. This effectively bypasses intended security controls, allowing unauthorized data retrieval or traversal of protected file system paths based on the context of the service running the PDF generation process.\nThis vulnerability affects all WeasyPrint versions prior to 70.0. No specific authentication is required if the target application's entry point for PDF generation is reachable by the attacker, and the exploitation is effectively constrained by the privileges of the user account running the WeasyPrint process."
}