CVE-2025-68616— WeasyPrint 代码问题漏洞

WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

指向未可信站点的URL重定向(开放重定向)

WeasyPrint 代码问题漏洞

WeasyPrint是Kozea开源的一种智能解决方案。可帮助 Web 开发人员创建 PDF 文件。 WeasyPrint 68.0之前版本存在代码问题漏洞，该漏洞源于default_url_fetcher存在服务端请求伪造保护绕过，可能导致攻击者访问内部网络资源。

N/A

N/A