PhpWeasyPrint is a PHP library for generating PDFs from URLs or HTML pages. In versions before 2.6.0, the `attachment` option in the Pdf class uses `file_get_contents()` to fetch content when the value validates as a URL using PHP's FILTER_VALIDATE_URL. This filter accepts multiple schemes including http, https, ftp, file, and PHP stream wrappers like php://. Because there is no restriction on the URL scheme, an attacker able to influence the `attachment` value can perform SSRF attacks to internal or external resources and also local file disclosure via file:// or php:// filters. The fetched content is embedded as a PDF attachment, allowing exfiltration of sensitive data. The vulnerability is identified as CWE-918 and has a CVSS 3.1 base score of 6.5 (medium severity). The issue was fixed in php-weasyprint version 2.6.0.

An attacker with the ability to control the `attachment` option can cause the server to make arbitrary requests to internal or external resources, including local files, potentially exposing sensitive information such as internal HTTP endpoints or cloud metadata. The exfiltrated data is embedded in the generated PDF as an attachment. This can lead to information disclosure without requiring user interaction. The vulnerability does not impact integrity or availability directly.

Upgrade php-weasyprint to version 2.6.0 or later, where this SSRF vulnerability is patched. No other official remediation or temporary fixes are documented. If upgrading is not immediately possible, restrict or sanitize inputs controlling the `attachment` option to prevent URLs with unsafe schemes such as file:// or php://. However, the recommended and definitive mitigation is to apply the official patch by upgrading.