En bref
- CVE-2025-1022 est une vulnérabilité ÉLEVÉE (CVSS 8.2) touchant spatie/browsershot.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.46%, plus élevée que 40.3% des vulnérabilités.
- Correctif : mettre à jour vers 5.0.5 ou plus récent.
Description
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
NVD description
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
**Note:** Further analysis has identified additional proof-of-concept exploits leveraging the vulnerable function. Developers using this package should ensure proper input validation to mitigate potential risks, as the issue remains unaddressed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free