Spatie vulnerabilities
We track 3 vulnerabilities in Spatie products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest Spatie vulnerabilities
- 7.5 High severity
browsershot: External Control of File Name or Path
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing pa
- 8.8 High severity
laravel-medialibrary: Incomplete List of Disallowed Inputs
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blockli
- 7.4 High severity
laravel-medialibrary: Server-Side Request Forgery
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method