CVE-2024-21549
published 2024-12-20CVE-2024-21549: Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An…
PriorityP351high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EPSS
0.61%
48.4th percentile
Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. **Note:** This is a bypass of the fix for [CVE-2024-21544](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spatie | browsershot | < 5.0.5 | 5.0.5 |
| spatie | browsershot | >= 0 < 5.0.3 | 5.0.3 |
| spatie | browsershot | >= 0 < 5.0.5 | 5.0.5 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.7HIGH
osv7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
spatie browsershot up to 5.0.2 URL Validation setUrl path traversal (SNYK-PHP-SPATIEBROWSERSHOT-8533023)
vuldb·2026-08-06·CVSS 8.6
CVE-2024-21549 [HIGH] spatie browsershot up to 5.0.2 URL Validation setUrl path traversal (SNYK-PHP-SPATIEBROWSERSHOT-8533023)
A vulnerability classified as critical has been found in spatie browsershot up to 5.0.2. The impacted element is the function setUrl of the component URL Validation Handler. The manipulation leads to path traversal.
This vulnerability is listed as CVE-2024-21549. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
Browsershot Local File Inclusion
ghsa·2025-02-05·CVSS 7.7
CVE-2025-1026 [HIGH] CWE-20 Browsershot Local File Inclusion
Browsershot Local File Inclusion
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files.
**Note:**
This is a bypass of the fix for [CVE-2024-21549](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023).
OSV
Browsershot Local File Inclusion
osv·2025-02-05·CVSS 7.7
CVE-2025-1026 [HIGH] Browsershot Local File Inclusion
Browsershot Local File Inclusion
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files.
**Note:**
This is a bypass of the fix for [CVE-2024-21549](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023).
GHSA
Browsershot Improper Input Validation vulnerability
ghsa·2024-12-20·CVSS 7.7
CVE-2024-21549 [HIGH] CWE-125 Browsershot Improper Input Validation vulnerability
Browsershot Improper Input Validation vulnerability
Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file.
**Note:**
This is a bypass of the fix for [CVE-2024-21544](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745).
OSV
Browsershot Improper Input Validation vulnerability
osv·2024-12-20·CVSS 7.7
CVE-2024-21549 [HIGH] Browsershot Improper Input Validation vulnerability
Browsershot Improper Input Validation vulnerability
Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file.
**Note:**
This is a bypass of the fix for [CVE-2024-21544](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-20
Published