Vulnerability Description
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content. **Note:** Further analysis has identified additional proof-of-concept exploits leveraging the vulnerable function. Developers using this package should ensure proper input validation to mitigate potential risks, as the issue remains unaddressed.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341
- https://github.com/spatie/browsershot/commit/bcfd608b264fab654bf78e199bdfbb03e93
- https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8d
- https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496747
- https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341
FAQ
What is CVE-2025-1022?
CVE-2025-1022 is a vulnerability with a CVSS score of 8.2 (HIGH). Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slash...
How severe is CVE-2025-1022?
CVE-2025-1022 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-1022?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.