CVE-2022-41706
published 2022-11-25CVE-2022-41706: Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the…
PriorityP339high8.2CVSS 3.1
AVNACLPRNUIRSCCHILAN
EPSS
0.61%
45.6th percentile
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spatie | browsershot | — | — |
| spatie | browsershot | >= 0 < 3.57.3 | 3.57.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Browsershot does not validate URL protocols passed to Browsershot URL method
ghsa·2022-11-25
CVE-2022-41706 [HIGH] CWE-20 Browsershot does not validate URL protocols passed to Browsershot URL method
Browsershot does not validate URL protocols passed to Browsershot URL method
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
OSV
Browsershot does not validate URL protocols passed to Browsershot URL method
osv·2022-11-25
CVE-2022-41706 [HIGH] Browsershot does not validate URL protocols passed to Browsershot URL method
Browsershot does not validate URL protocols passed to Browsershot URL method
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-25
Published