CVE-2026-55073 Kozea CVE debrief

Who should care

Server-side application developers and administrators using WeasyPrint for PDF creation should assess their exposure and verify configurations to prevent potential local file reads.

Why it matters

CVE-2026-55073 is a restriction bypass vulnerability in WeasyPrint that allows for potential local file reads and embedding in generated PDFs. Server-side application developers and administrators should assess exposure, verify configurations, and prioritize upgrading to version 70.0 or later.

• Potential unauthorized local file reads through crafted PDF creation requests.
• Possible embedding of local file contents in generated PDFs.
• Verification of url_fetcher configurations and input validation is required.
• Upgrade to WeasyPrint version 70.0 or later to remediate the vulnerability.

Technical summary

A restriction bypass vulnerability exists in WeasyPrint versions prior to 70.0. Server-side applications configuring a restrictive url_fetcher and passing attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options, potentially leading to local file reads. The issue allows for reading local files and embedding them in output PDFs. Developers should assess exposure, verify configurations of url_fetcher, and prioritize upgrading to version 70.0 or later.

Defensive priority

Assess exposure for server-side applications using WeasyPrint versions prior to 70.0, verify configurations of url_fetcher, and prioritize upgrading to version 70.0 or later.

Recommended defensive actions

• Assess server-side application configurations using WeasyPrint for restrictive url_fetcher setups.
• Verify if applications pass attacker-influenced values to HTML.write_pdf().
• Prioritize upgrading WeasyPrint to version 70.0 or later.
• Review and restrict usage of xmp_metadata and stylesheets options.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the restriction bypass vulnerability in WeasyPrint versions prior to 70.0. The issue allows for the reading of local files and embedding them in output PDFs through the xmp_metadata or stylesheets options.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.