WeasyPrint versions before 70.0 contain an SSRF vulnerability (CWE-918) where server-side applications that use a restrictive url_fetcher can have these restrictions bypassed. Specifically, the xmp_metadata option calls select_source() without using the document's url_fetcher, enabling an attacker to read and embed accessible local files in the output PDF. Additionally, the stylesheets option constructs CSS() without the document url_fetcher, allowing loading of local or internal resources and propagating a permissive fetcher through nested CSS imports and url() references. This vulnerability is addressed and fixed in WeasyPrint version 70.0.

An attacker able to influence inputs to HTML.write_pdf() can bypass url_fetcher restrictions and cause the server to read local files and embed their contents in generated PDFs. This leads to local file disclosure (confidential information exposure). The CVSS score of 6.2 reflects a medium severity with high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild.

Upgrade WeasyPrint to version 70.0 or later, where this SSRF vulnerability is fixed. No other mitigation is indicated or required according to the available data.