CVE-2024-28184

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-2818510.0Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, wh CVE-2024-281867.1FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, w CVE-2024-281877.2SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 CVE-2024-281885.3Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyt CVE-2024-2818910.0Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. CVE-2024-28196.5Incorrect Default Permissions, Improper Preservation of Permissions vulnerability in Hitachi Ops Center Common Services allows File Manipula CVE-2024-281905.4Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malic CVE-2024-281915.4Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inje CVE-2024-281925.3your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the p CVE-2024-281936.5your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 allows users to create a public token in CVE-2024-281949.8your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) se CVE-2024-281958.8your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow a