spatie/browsershot

Registry

GitHub

Releases163

Frequency3 weeks 3 days

Last Release about 2 months ago

Stars5.05K

Convert HTML to an image, PDF or string

Log in to subscribe

CVE History

CVE	Published	CVSS v2	CVSS v3
CVE-2024-21549	Dec 20, 2024	N/A	N/A
Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This is a bypass of the fix for [CVE-2024-21544](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745).
CVE-2024-21547	Dec 18, 2024	N/A	N/A
Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\\. An attacker could read any file on the server by exploiting the normalization of \ into /.
CVE-2024-21544	Dec 13, 2024	N/A	N/A
Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, resulting in Local File Inclusion, which allows the attacker to read sensitive files on the server.
CVE-2022-41706	Nov 25, 2022	8.2 HIGH	N/A
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
CVE-2022-43983	Nov 25, 2022	8.2 HIGH	N/A
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol.
CVE-2022-43984	Nov 25, 2022	8.2 HIGH	N/A
Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol.
CVE-2020-7790	Dec 11, 2020	N/A	5 MEDIUM
This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.