PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, "pontedilana/php-weasyprint" fetches the content of option values server-side via "file_get_contents()" when the value looks like a URL, without restricting the URL scheme. The "attachment" option of "Pdf" is the reachable sink: any value that passes "isOptionUrl()" ("filter_var(..., FILTER_VALIDATE_URL)") is downloaded by the PHP process and embedded into the generated PDF. Because "FILTER_VALIDATE_URL" accepts "http", "https", "ftp", "file" and PHP stream wrappers such as "php://", an attacker who can influence the "attachment" value reaches both a Server-Side Request Forgery primitive (e.g. internal HTTP endpoints, cloud metadata) and a local file disclosure primitive ("file://", "php://filter/..."), with the fetched bytes exfiltrated as a PDF attachment. This is the same class of issue KnpLabs/snappy patched for its "xsl-style-sheet" option in GHSA-c5fp-p67m-gq56. The library is documented as a one-to-one substitute for KnpLabs/snappy and shares the same code shape. PhpWeasyPrint version 2.6.0 contains a patch for the issue.