URL Redirection to Untrusted Site ('Open Redirect')
CVE-2025-68616
Summary
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a Server-Side Request Forgery (SSRF) protection bypass exists in WeasyPrint's "default_url_fetcher". The vulnerability allows attackers to access internal network resources (such as "localhost" services or cloud metadata endpoints) even when a developer has implemented a custom "url_fetcher" to block such access. This occurs because the underlying "urllib" library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- HIGH
- NONE
CWE-601 - Open Redirect
An open redirect attack employs a URL parameter, HTML refresh tags, or a DOM based location change to exploit the trust of a vulnerable domain to direct the users to a malicious website. The attack could lead to higher severity vulnerabilities such as unauthorized access control, account takeover, XSS, and more.
References
Advisory Timeline
- Published
