CVE-2026-55073

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim. This issue is fixed in version 70.0.

• CWE-918

• https://github.com/Kozea/WeasyPrint/commit/289e278439b017cd9263b4cd4727026987f86443
• https://github.com/Kozea/WeasyPrint/releases/tag/v70.0
• https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jf6q-chmf-3h3v
• https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jf6q-chmf-3h3v

Published

Sep 14, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55067Vikunja is an open-source self-hosted task management platfo…5
• CVE-2026-55068free5GC is an open-source implementation of the 5G core netw…9.3
• CVE-2026-55069Kestra is an open-source, event-driven orchestration platfor…8.7
• CVE-2026-5507When restoring a session from cache, a pointer from the seri…4
• CVE-2026-55071MCP-for-Stata is a MCP server for integrating Stata into age…8.4
• CVE-2026-55072Pimcore is an Open Source Data & Experience Management Platf…8.5
• CVE-2026-55074Ansible FreeBSD Jail Connection Plugin is an Ansible connect…8.2
• CVE-2026-55075Coder allows organizations to provision remote development e…7.4
• CVE-2026-55076Coder allows organizations to provision remote development e…7.4
• CVE-2026-55077Coder allows organizations to provision remote development e…7.2
• CVE-2026-55078Coder allows organizations to provision remote development e…6.5
• CVE-2026-55079Coder allows organizations to provision remote development e…6.5