Is CVE-2025-68616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68616 being exploited in the wild.

How severe is CVE-2025-68616?

High severity, with a CVSS score of 7.5, published 19 January 2026.

Which products and versions are affected?

Kozea Weasyprint < 68.0; weasyprint (PyPI) ECOSYSTEM:introduced=0,fixed=68.0.

Is there a fix for CVE-2025-68616?

Yes. weasyprint (PyPI): upgrade to 68.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-68616 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-68616?

Check whether you run Kozea Weasyprint or weasyprint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68616: Kozea WeasyPrint SSRF bypass in default_url_fetcher

Q: Which products and versions are affected?

Kozea Weasyprint < 68.0; weasyprint (PyPI) ECOSYSTEM:introduced=0,fixed=68.0.

Q: Is there a fix for CVE-2025-68616?

Yes. weasyprint (PyPI): upgrade to 68.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-68616 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-68616?

Check whether you run Kozea Weasyprint or weasyprint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68616 · Severity: high · CVSS 7.5 · Published 2026-01-19

WeasyPrint, a library used to convert HTML and CSS into PDF documents, contains a security flaw that allows attackers to bypass network restrictions. By using specially crafted web addresses that redirect to internal systems, an attacker can trick the software into accessing private data, such as internal server information or cloud credentials, that it was supposed to be blocked from reaching. This could lead to the exposure of sensitive internal business data or unauthorized access to cloud infrastructure.

Technologies: Kozea Weasyprint, weasyprint (PyPI). Vendors: Kozea, PyPI.

Quick answers

Is CVE-2025-68616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68616 being exploited in the wild.
How severe is CVE-2025-68616?: High severity, with a CVSS score of 7.5, published 19 January 2026.
Which products and versions are affected?: Kozea Weasyprint < 68.0; weasyprint (PyPI) ECOSYSTEM:introduced=0,fixed=68.0.
Is there a fix for CVE-2025-68616?: Yes. weasyprint (PyPI): upgrade to 68.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68616 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-68616?: Check whether you run Kozea Weasyprint or weasyprint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weasyprint (PyPI): upgrade to 68.0 or later
```
pip install "weasyprint>=68.0"
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in WeasyPrint's 'default_url_fetcher' component due to a Time-of-Check to Time-of-Use (TOCTOU) flaw. While developers can implement custom 'url_fetcher' functions to validate URLs, the underlying Python 'urllib.request.urlopen' library automatically follows HTTP redirects (3xx status codes) without re-invoking the validation logic for the new destination. A remote attacker can provide a benign-looking URL that passes initial checks but redirects to sensitive internal resources like localhost services or cloud metadata endpoints (169.254.169.254). This vulnerability is addressed in version 68.0.

Affected products

Kozea WeasyPrint < 68.0

Identifiers

CVE-2025-68616
GHSA-983w-rhvv-gwmv
PYSEC-2026-2034

Timeline

2026-01-19: disclosed
2026-01-19: patched: Fixed in version 68.0
2026-01-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.