Spatie/browsershot vulnerabilities
We track 6 vulnerabilities in Spatie/browsershot products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on April 4, 2025.
Latest Spatie/browsershot vulnerabilities
- 8.2 High severity
spatie/browsershot: Server-Side Request Forgery
Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.
- 8.6 High severity
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input…
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files. **Note:** This
- 8.2 High severity
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input…
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This
- 8.6 High severity
Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input…
Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary fil
- 7.5 High severity
spatie/browsershot: Improper Limitation of a Pathname to a Restricted Directory
Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\\. An attacker could read any file on the server by exploiting the normaliz
- 8.6 High severity
Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input…
Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, r