CVE-2024-28184CWE-829

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

High · published March 9, 2024

CVSS v3.1
7.4
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00737 · 54.0th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2024-03-09T00:50Z
EPSS history
Timeline
  • 09 MAR 00:50Z
    WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
    cvelistv5