162 matches found
CVE-2026-126779
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CVE-2026-126779
Spatie Browsershot versions 2.2.0 through 5.5.0 are vulnerable to a local file read vulnerability. The flaw exists because the setHtml() function allows attackers to supply root-relative references in HTML. By embedding elements such as iframe, img, link, or script that reference paths like /etc/...
CVE-2026-126779
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
EUVD-2026-123773
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CVE-2026-126779 Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CVE-2026-126779 Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
PT-2026-145431
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CVE-2026-126779: spatie browsershot: Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server…
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CLSA-2026-1771289500 TuxCare security update for spatie/browsershot (1 CVE)
TuxCare rebuilt spatie/browsershot to address 1 CVE. Fixed in 4.4.0-p1+tuxcare...
CLSA-2026-1768956702 TuxCare security update for spatie/browsershot (5 CVEs)
TuxCare rebuilt spatie/browsershot to address 5 CVEs. Fixed in 3.61.0-p1+tuxcare...
CLSA-2026-1771289503 TuxCare security update for spatie/browsershot (1 CVE)
TuxCare rebuilt spatie/browsershot to address 1 CVE. Fixed in 3.61.0-p2+tuxcare...
CLSA-2026-1777509609 TuxCare security update for spatie/browsershot (5 CVEs)
TuxCare rebuilt spatie/browsershot to address 5 CVEs. Fixed in 4.4.0-p2+tuxcare...
PT-2026-73760
TuxCare rebuilt spatie/browsershot to address 1 CVE. Fixed in 3.61.0-p2+tuxcare...
PT-2026-73711
TuxCare rebuilt spatie/browsershot to address 5 CVEs. Fixed in 3.61.0-p1+tuxcare...
PT-2026-74655
TuxCare rebuilt spatie/browsershot to address 5 CVEs. Fixed in 4.4.0-p2+tuxcare...
PT-2026-73759
TuxCare rebuilt spatie/browsershot to address 1 CVE. Fixed in 4.4.0-p1+tuxcare...
CVE-2025-1026
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files. Note: This is a bypass of the fix for CVE-2024-21549...
CVE-2025-1022
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html, which can be bypassed by omitting the slashes in the file URI e.g., file:../../../../etc/passwd. This is due to missing validations of the use...