PT-2026-3446 · Unknown · Weasyprint

Published 2026-01-19 · Updated 2026-01-21 · CVE-2025-68616

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WeasyPrint versions prior to 68.0

Description WeasyPrint is a tool used by web developers to generate PDF documents. A server-side request forgery (SSRF) protection bypass exists in WeasyPrint’s default url fetcher for versions prior to 68.0. This allows attackers to access internal network resources, such as localhost services or cloud metadata endpoints, even when a developer has implemented a custom url fetcher to block such access. The issue occurs because the urllib library automatically follows HTTP redirects without re-validating the new destination against the developer’s security policy. The vulnerable component is the default url fetcher.

Recommendations Update to WeasyPrint version 68.0 or later.

Exploit

Fix

SSRF

Open Redirect

Weakness Enumeration

CWE-918

CWE-601

Related Identifiers

CVE-2025-68616

GHSA-983W-RHVV-GWMV

OPENSUSE-SU-2026:10079-1

OPENSUSE-SU-2026:20069-1

Affected Products

Weasyprint

References · 18

• 🔥 https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-983w-rhvv-gwmv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68616.json · Exploit
• https://github.com/Kozea/WeasyPrint/commit/b6a14f0f3f4ce9c0c75c1a2d73cb1c5d43f0e565 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:20069-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-68616 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68616 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10079-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-68616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68616 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-68616 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-983w-rhvv-gwmv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-68616 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68616 · Security Note
• https://github.com/Kozea/WeasyPrint · Note
• https://twitter.com/CVEnew/status/2013277740783317361 · Twitter Post