PhpWeasyPrint, a PHP library for generating PDFs from a URL or HTML, processes option values with file_get_contents() when they look like URLs. The attachment option is a reachable sink that accepts any value validated by FILTER_VALIDATE_URL, which includes http, https, ftp, file, and PHP stream wrappers such as php://. Because the library does not restrict the scheme, an attacker who can influence the attachment value can cause the server to fetch arbitrary URLs or local files. This results in a Server‑Side Request Forgery that can reach internal HTTP endpoints or cloud metadata services, and a local file disclosure that can read files via file:// or php://filter wrappers. The fetched data is then embedded in generated PDF and exfiltrated as an attachment, effectively exposing sensitive data or internal services.

The vulnerability affects the PHP library pontedilana/php-weasyprint in all releases prior to version 2.6.0. Any application that incorporates this library and accepts untrusted values for the attachment option is potentially impacted.

The CVSS score of 6.5 classifies the issue as a moderate severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. However, because the sink is server‑side and the input is widely derived from user data, an attacker can exploit the issue if they can influence the attachment value, making the risk contingent on the application's attack surface and the ability to supply malicious configuration.