Spatie browsershot up to 5.0.4 Browsershot::html path traversal

Summaryinfo

A vulnerability was found in Spatie browsershot up to 5.0.4. It has been classified as critical. Affected by this issue is the function Browsershot::html. This manipulation causes path traversal. This vulnerability is handled as CVE-2025-1022. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Spatie browsershot up to 5.0.4 and classified as critical. Affected by this vulnerability is the function Browsershot::html. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-24. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.

It is possible to read the advisory at security.snyk.io. This vulnerability is known as CVE-2025-1022 since 02/04/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 5.0.5 eliminates this vulnerability. Applying the patch bcfd608b264fab654bf78e199bdfbb03e9323eb7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Spatie

Name

• browsershot

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4

License

• open-source

Website

• Product: https://github.com/spatie/browsershot/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion