Description
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Browsershot | 3.57.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | spatie/browsershot | < 3.57.3 | 3.57.3 | GHSA-8c2c-jxwj-jqgf |