PhpWeasyPrint is a PHP library for generating PDFs from URLs or HTML pages. Prior to version 2.6.0, it uses file_get_contents() to fetch the content of option values that look like URLs, including the 'attachment' option of the Pdf class. The URL validation relies on FILTER_VALIDATE_URL, which accepts schemes such as http, https, ftp, file, and PHP stream wrappers like php://. This allows an attacker who can influence the 'attachment' option to perform Server-Side Request Forgery (SSRF) by making the server fetch arbitrary internal or external resources, including local files or PHP streams. The fetched content is then embedded as a PDF attachment, enabling exfiltration. This vulnerability is tracked as CVE-2026-49359 and was patched in php-weasyprint version 2.6.0.

An attacker with the ability to control the 'attachment' option value can cause the server to fetch arbitrary URLs or local files. This can lead to disclosure of sensitive internal resources, local files, or cloud metadata accessible from the server environment. The vulnerability allows exfiltration of the fetched content embedded in generated PDFs. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

PhpWeasyPrint version 2.6.0 contains a patch that addresses this vulnerability. Users should upgrade to version 2.6.0 or later to remediate this issue. No additional vendor advisory or temporary mitigations are provided. Patch status is confirmed by the version bump and description. Until upgraded, avoid passing untrusted input to the 'attachment' option or restrict URL schemes manually.