[MEDIUM] PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

PKSA-q4hm-4pvf-f13w CVE-2026-49359 GHSA-x8g9-h984-pc36

Affected package: pontedilana/php-weasyprint

Affected version: <=2.5.1

Reported by:
GitHub