Description
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| spatie | browsershot | 2.2.0 – < 5.5.0 | 5.5.0 |
References
- https://github.com/spatie/browsershot/pull/989 patch issue-tracking
- https://github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516 patch
- browsershot 5.5.0 Release Notes release-notes
- https://github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.php#L242-L248 technical-description
- VulnCheck Advisory: Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml() third-party-advisory