VYPR
← All advisories
High severityOSV Advisory· Published Jan 19, 2026· Updated Jan 20, 2026

WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

CVE-2025-68616

Description

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's default_url_fetcher. The vulnerability allows attackers to access internal network resources (such as localhost services or cloud metadata endpoints) even when a developer has implemented a custom url_fetcher to block such access. This occurs because the underlying urllib library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
weasyprintPyPI
< 68.068.0

Affected products

1

Patches

1
b6a14f0f3f4c

Merge remote-tracking branch 'security/filter-redirections'

https://github.com/Kozea/WeasyPrintGuillaume AyoubJan 19, 2026via ghsa
commit
2 files changed · +15 −2
  • docs/changelog.rst+10 −0 modified
    @@ -7,6 +7,16 @@ Version 68.0
 
 Released on 2026-01-19.
 
+**This is a security update (CVE-2025-68616).**
+
+We strongly recommend to upgrade WeasyPrint to the latest version if you use the
+``default_url_fetcher`` function in your custom URL fetcher, or if you use the
+``allowed_protocols`` parameter of the ``default_url_fetcher`` function.
+
+Security:
+
+- Always use URL fetcher for HTTP redirects
+
 Python API:
 
 * ``default_url_fetcher()`` is deprecated, use the new ``URLFetcher`` class instead, see
  • weasyprint/urls.py+5 −2 modified
    @@ -198,9 +198,12 @@ def default_url_fetcher(url, timeout=10, ssl_context=None, http_headers=None,
     """
     warnings.warn(
         "default_url_fetcher is deprecated and will be removed in WeasyPrint 69.0, "
-        "please use URLFetcher instead.",
+        "please use URLFetcher instead. For security reasons, HTTP redirects are not "
+        "supported anymore with default_url_fetcher, but are with URLFetcher.\n\nSee "
+        "https://doc.courtbouillon.org/weasyprint/stable/first_steps.html#url-fetchers",
         category=DeprecationWarning)
-    fetcher = URLFetcher(timeout, ssl_context, http_headers, allowed_protocols)
+    fetcher = URLFetcher(
+        timeout, ssl_context, http_headers, allowed_protocols, allow_redirects=False)
     return fetcher.fetch(url)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.