spatie/browsershot vulnerabilities

Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalization in the browser, allowing the file:// check to be bypassed with file:\. An attacker could read any file on the server.

The spatie/browsershot package before version 5.0.5 is vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(). Attackers can bypass file URI scheme blocking (e.g., file:// and file:/) by omitting slashes, e.g., file:../../../../etc/passwd, leading to arbitrary file read.

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this by utilizing view-source:file://, allowing arbitrary file reading on a local file. This is a bypass of the fix for CVE-2024-21544.