Description
This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | spatie/browsershot | 0.0.0 – < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | spatie/browsershot | < 3.40.1 | 3.40.1 | GHSA-rv74-mh27-4jpv |