요약
- CVE-2025-1022은(는) spatie/browsershot에 영향을 주는 높음 (CVSS 8.2) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.46%, 전체 취약점의 40.3%보다 높음.
- 조치: 5.0.5 이상으로 업데이트하세요.
Description
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
NVD description
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
**Note:** Further analysis has identified additional proof-of-concept exploits leveraging the vulnerable function. Developers using this package should ensure proper input validation to mitigate potential risks, as the issue remains unaddressed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free