Every CVE Search/ Get API key

CVE-2024-28184

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

7.4 HighFix available

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.74%Up 0.7 points since Mar 9, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.4

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Record
CVE-2024-28184
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-829
Updated
2026-11-02
EUVDEUVD-2024-0798 7.4

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Record
EUVD-2024-0798
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-35jj-wx47-4w8r 7.4

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

Impact

Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.

Patches

Fixed by 734ee8e that’s included in 61.2

Workarounds

  • Check that no PDF attachment is defined in source HTML.
  • Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
Record
GHSA-35jj-wx47-4w8r
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-829
Updated
2026-11-02
NVD 7.4

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Record
CVE-2024-28184
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-829
Updated
2026-11-02
OSV 7.4

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Record
CVE-2024-28184
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-829
Updated
2026-11-02
OSVDEBIAN-CVE-2024-28184 7.4

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Record
DEBIAN-CVE-2024-28184
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVGHSA-35jj-wx47-4w8r 7.4

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

Impact

Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.

Patches

Fixed by 734ee8e that’s included in 61.2

Workarounds

  • Check that no PDF attachment is defined in source HTML.
  • Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
Record
GHSA-35jj-wx47-4w8r
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-829
Updated
2026-11-02
OSVPYSEC-2026-2033 7.4

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

Impact

Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.

Patches

Fixed by 734ee8e that’s included in 61.2

Workarounds

  • Check that no PDF attachment is defined in source HTML.
  • Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
Record
PYSEC-2026-2033
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2024-28184 7.4

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Record
UBUNTU-CVE-2024-28184
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
weasyprint
PyPI
 61.0 to 61.1
61.2
weasyprint
Debian:13
 before 61.2-1
61.2-1
weasyprint
Debian:14
 before 61.2-1
61.2-1
weasyprint
PyPI
 61.0 up to 61.2, plus listed versions
61.1
61.2
weasyprint
Ubuntu:20.04:LTS
 All versions, plus listed versions
50-251-151-2
 None known
weasyprint
Ubuntu:22.04:LTS
 All versions, plus listed versions
51-251-353.4-154.0-154.1-1
 None known
weasyprint
Ubuntu:24.04:LTS
 All versions, plus listed versions
59.0-160.2-161.0-161.1-1
 None known
weasyprint
Ubuntu:25.10
 All versions, plus listed versions
62.3-1
 None known
weasyprint
Ubuntu:26.10
 All versions, plus listed versions
67.0-169.0-169.0-2
 None known
weasyprint
Ubuntu:26.04:LTS
 All versions, plus listed versions
62.3-162.3-1build167.0-1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-28184 is a high vulnerability (CVSS 7.4) in Kozea Weasyprint, published March 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in weasyprint 61.2.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open