CVE-2026-110646

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl value, which executeOnWindows passes unescaped to PHP exe...

CVE-2026-110646 Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl value, which executeOnWindows passes unescaped to PHP exe...

EUVD-2026-101274

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl value, which executeOnWindows passes unescaped to PHP exe...

CVE-2026-110646

The Beganovich snappdf library (versions 1.1.0 before 6.1.0) is vulnerable to an OS command injection on Windows systems. The flaw exists because the setUrl() function allows attackers to supply cmd.exe metacharacters, such as &, which are then passed unescaped by the executeOnWindows() function ...

CVE-2026-110646 Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl value, which executeOnWindows passes unescaped to PHP exe...

Browsershot Server-Side Request Forgery (SSRF) via setURL() Function

Versions of the package spatie/browsershot from 0.0.0 to 5.0.3 are vulnerable to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories...

CVE-2025-3192

Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories...

Browsershot 安全漏洞

Browsershot is an open source tool from Spatie. It is used to convert web pages into images or pdfs. Browsershot version 0.0.0 there is a security vulnerability , the vulnerability stems from the setUrl function lack of input restrictions , which may lead to server-side request forgery...

CVE-2025-3192: Server-Side Request Forgery (SSRF)

Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories...

CVE-2025-1026

Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files. Note: This is a bypass of the fix for "CVE-2024-2154...

CVE-2025-1026: Improper Input Validation

Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files. Note: This is a bypass of the fix for CVE-2024-21549...

PT-2025-4136

Name of the Vulnerable Software and Affected Versions spatie/browsershot versions prior to 5.0.5 Description The issue is related to improper URL validation through the setUrl method, resulting in a Local File Inclusion that allows attackers to read sensitive files. This is a bypass of a previous...

Server-side Request Forgery (SSRF)

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input, enabling attackers to access localhos...

CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

CVE-2024-21549: Improper Input Validation

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

Spatie Browsershot 安全漏洞

Spatie Browsershot is a codebase from the Belgian Spatie team that converts browser pages into PDF or image formats based on Php and Javascript. A security vulnerability exists in Spatie Browsershot versions prior to 5.0.3, which stems from improper URL validation via the setUrl method...

Improper Input Validation

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the...

CVE-2024-21544

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace %20 before the file:// protocol, resulting in Local File Inclusion, which...

CVE-2024-21544: Improper Input Validation

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace %20 before the file:// protocol, resulting in Local File Inclusion, which...

PT-2024-18956

Name of the Vulnerable Software and Affected Versions spatie/browsershot versions prior to 5.0.1 Description The issue is related to improper input validation due to incorrect URL validation through the setUrl method. An attacker can exploit this by using leading whitespace %20 before the file://...