CVE-2025-68616 WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
Attackers can bypass SSRF protections in WeasyPrint to access internal network resources via HTTP redirects, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68616?
CVE-2025-68616 is a high-severity server-side request forgery vulnerability in Kozea WeasyPrint, published on 19 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
Which versions are affected by CVE-2025-68616?
3 open source packages ship an affected version, including weasyprint. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
weasyprint PyPI | All versions | 68.0 |
weasyprint PyPI | All versions | 68.0 |
weasyprint PyPI | All versions | 68.0 |
Linux distribution packages (2)
python-weasyprint openSUSE:Leap 16.0 | All versions | 65.1-bp160.2.1 |
python-weasyprint openSUSE:Tumbleweed | All versions | 68.0-1.1 |
Products include Kozea Weasyprint.
How do I fix CVE-2025-68616?
Upgrade weasyprint to 68.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-68616 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68616 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2025-68616, GHSA-983w-rhvv-gwmv, PYSEC-2026-2034, UBUNTU-CVE-2025-68616, openSUSE-SU-2026:10079-1, openSUSE-SU-2026:20069-1.