CVE-2025-68616

HIGH

WeasyPrint < 68.0 - Server-Side Request Forgery via HTTP Redirect Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-68616. PoCs published by rauljvc8.

AI-analyzed exploit summary Detailed technical analysis of CVE-2025-68616, an SSRF protection bypass in WeasyPrint's `default_url_fetcher` due to improper HTTP redirect handling. The writeup includes root cause analysis, patch diff reference, and a non-exploitative PoC demonstrating the vulnerability's impact (file:// resource access) and remediation verification.

Description

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.

Exploits (1)

github WRITEUP
by rauljvc8 · poc
https://github.com/rauljvc8/CVE-2025-68616-Detecting-and-Patching-an-SSRF-in-WeasyPrint-with-Wazuh

Detailed technical analysis of CVE-2025-68616, an SSRF protection bypass in WeasyPrint's `default_url_fetcher` due to improper HTTP redirect handling. The writeup includes root cause analysis, patch diff reference, and a non-exploitative PoC demonstrating the vulnerability's impact (file:// resource access) and remediation verification.

Classification
Writeup 98%
Attack Type
Ssrf
Complexity
Moderate
Reliability
Reliable
Target: WeasyPrint versions prior to 68.0
No auth needed
Prerequisites: WeasyPrint installed (<68.0) · Attacker-controlled HTML input to WeasyPrint · Ability to generate a PDF from the malicious HTML
mistral-large-3 · analyzed Jul 19, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 7.5
EPSS 0.0050
EPSS Percentile 40.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-601 CWE-918
Status published
Products (3)
kozea/weasyprint < 68.0
Kozea/WeasyPrint < 68.0
pypi/weasyprint 0 - 68.0PyPI
Published Jan 19, 2026
Tracked Since Feb 18, 2026