Browsershot Path Traversal
The advisory, in context
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 5.0.5
Fixed in 5.0.5
157 explicitly affected versions
0.1.0, 0.1.1, 0.1.2, 0.1.3, 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.9.1, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 3.0.0, 3.1.0, 3.10.0, 3.11.0, 3.11.1, 3.12.0, 3.13.0, 3.14.0, 3.14.1, 3.15.0, 3.16.0, 3.16.1, 3.17.0, 3.18.0, 3.19.0, 3.2.0, 3.2.1, 3.20.0, 3.20.1, 3.22.0, 3.22.1, 3.23.0, 3.23.1, 3.24.0, 3.25.0, 3.25.1, 3.26.0, 3.26.1, 3.26.2, 3.26.3, 3.27.0, 3.29.0, 3.3.0, 3.3.1, 3.30.0, 3.31.0, 3.31.1, 3.32.0, 3.32.1, 3.32.2, 3.33.0, 3.33.1, 3.34.0, 3.35.0, 3.36.0, 3.37.0, 3.37.1, 3.37.2, 3.38.0, 3.39.0, 3.4.0, 3.40.0, 3.40.1, 3.40.2, 3.40.3, 3.41.0, 3.41.1, 3.41.2, 3.42.0, 3.44.0, 3.44.1, 3.45.0, 3.46.0, 3.47.0, 3.48.0, 3.49.0, 3.5.0, 3.50.0, 3.50.1, 3.50.2, 3.51.0, 3.52.0, 3.52.1, 3.52.2, 3.52.3, 3.52.4, 3.52.5, 3.52.6, 3.53.0, 3.54.0, 3.55.0, 3.56.0, 3.57.0, 3.57.1, 3.57.2, 3.57.3, 3.57.4, 3.57.5, 3.57.6, 3.57.7, 3.57.8, 3.58.0, 3.58.1, 3.58.2, 3.59.0, 3.6.0, 3.60.0, 3.60.1, 3.60.2, 3.61.0, 3.7.0, 3.8.0, 3.8.1, 3.9.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.2.0, 4.2.1, 4.3.0, 4.3.1, 4.4.0, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.3",
"1.0.0",
"1.1.0",
"1.2.0",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.3.0",
"1.4.0",
"1.5.0",
"1.5.1",
"1.5.2",
"1.5.3",
"1.5.4",
"1.6.0",
"1.7.0",
"1.8.0",
"1.9.0",
"1.9.1",
"2.0.0",
"2.0.1",
"2.0.2",
"2.0.3",
"2.1.0",
"2.2.0",
"2.3.0",
"2.4.0",
"2.4.1",
"2.4.2",
"3.0.0",
"3.1.0",
"3.10.0",
"3.11.0",
"3.11.1",
"3.12.0",
"3.13.0",
"3.14.0",
"3.14.1",
"3.15.0",
"3.16.0",
"3.16.1",
"3.17.0",
"3.18.0",
"3.19.0",
"3.2.0",
"3.2.1",
"3.20.0",
"3.20.1",
"3.22.0",
"3.22.1",
"3.23.0",
"3.23.1",
"3.24.0",
"3.25.0",
"3.25.1",
"3.26.0",
"3.26.1",
"3.26.2",
"3.26.3",
"3.27.0",
"3.29.0",
"3.3.0",
"3.3.1",
"3.30.0",
"3.31.0",
"3.31.1",
"3.32.0",
"3.32.1",
"3.32.2",
"3.33.0",
"3.33.1",
"3.34.0",
"3.35.0",
"3.36.0",
"3.37.0",
"3.37.1",
"3.37.2",
"3.38.0",
"3.39.0",
"3.4.0",
"3.40.0",
"3.40.1",
"3.40.2",
"3.40.3",
"3.41.0",
"3.41.1",
"3.41.2",
"3.42.0",
"3.44.0",
"3.44.1",
"3.45.0",
"3.46.0",
"3.47.0",
"3.48.0",
"3.49.0",
"3.5.0",
"3.50.0",
"3.50.1",
"3.50.2",
"3.51.0",
"3.52.0",
"3.52.1",
"3.52.2",
"3.52.3",
"3.52.4",
"3.52.5",
"3.52.6",
"3.53.0",
"3.54.0",
"3.55.0",
"3.56.0",
"3.57.0",
"3.57.1",
"3.57.2",
"3.57.3",
"3.57.4",
"3.57.5",
"3.57.6",
"3.57.7",
"3.57.8",
"3.58.0",
"3.58.1",
"3.58.2",
"3.59.0",
"3.6.0",
"3.60.0",
"3.60.1",
"3.60.2",
"3.61.0",
"3.7.0",
"3.8.0",
"3.8.1",
"3.9.0",
"4.0.0",
"4.0.1",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.1.0",
"4.1.1",
"4.1.2",
"4.1.3",
"4.2.0",
"4.2.1",
"4.3.0",
"4.3.1",
"4.4.0",
"5.0.0",
"5.0.1",
"5.0.2",
"5.0.3",
"5.0.4"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2025-1022
- https://github.com/spatie/browsershot/commit/bcfd608b264fab654bf78e199bdfbb03e9323eb7
- https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72
- https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341
- https://github.com/spatie/browsershot
- https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496747