Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-68616

Good to know:

icon
icon
icon

Date: January 19, 2026

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's "default_url_fetcher". The vulnerability allows attackers to access internal network resources (such as "localhost" services or cloud metadata endpoints) even when a developer has implemented a custom "url_fetcher" to block such access. This occurs because the underlying "urllib" library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.

Severity Score

Related Resources (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-68616
https://github.com/Kozea/WeasyPrint/commit/b6a14f0f3f4ce9c0c75c1a2d73cb1c5d43f0e565
https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-983w-rhvv-gwmv
https://github.com/Kozea/WeasyPrint
https://www.mend.io/vulnerability-database/CVE-2025-68616

Severity Score

Weakness Type (CWE)

Server-Side Request Forgery (SSRF)

CWE-918

URL Redirection to Untrusted Site ('Open Redirect')

CWE-601

Top Fix

icon

Upgrade Version

Upgrade to version weasyprint - 68.0;https://github.com/Kozea/WeasyPrint.git - v68.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us