CVE-2025-1022
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The spatie/browsershot package before version 5.0.5 is vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(). Attackers can bypass file URI scheme blocking (e.g., file:// and file:/) by omitting slashes, e.g., file:../../../../etc/passwd, leading to arbitrary file read.
Risk Assessment
The risk involves potential arbitrary file read from the server, such as /etc/passwd, which could lead to sensitive data leakage and further system compromise.
Recommendation
Immediately update the spatie/browsershot package to version 5.0.5 or later. If an update is not possible, implement additional input validation in the setHtml function to block all file URI schemes.
Other vulnerabilities in spatie/browsershot
See all- CVE-2024-21547High
Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalization in the browser, allowing the file:// check to be bypassed with file:\. An attacker could read any file on the server.
- CVE-2024-21549High
Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this by utilizing view-source:file://, allowing arbitrary file reading on a local file. This is a bypass of the fix for CVE-2024-21544.
Original NVD description (English source)
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content. **Note:** Further analysis has identified additional proof-of-concept exploits leveraging the vulnerable function. Developers using this package should ensure proper input validation to mitigate potential risks, as the issue remains unaddressed.