CVE-2025-1022
Published: 05 February 2025
Description
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
Security Summary
CVE-2025-1022 is an Improper Input Validation vulnerability (CWE-20) affecting versions of the PHP package spatie/browsershot prior to 5.0.5. The issue resides in the setHtml function, which is invoked by Browsershot::html(), where user-supplied HTML content lacks proper validation to block file URI schemes. Attackers can bypass intended restrictions by omitting slashes in file URIs, such as using "file:../../../../etc/passwd" instead of blocked forms like "file://" or "file:/", allowing arbitrary file reads during HTML rendering.
Remote attackers require no privileges or user interaction to exploit this over the network with low complexity, as indicated by the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By injecting malicious HTML into a Browsershot::html() call, they can achieve high-impact confidentiality loss through local file disclosure, such as reading sensitive system files, alongside low integrity impact.
Mitigation involves upgrading to spatie/browsershot version 5.0.5 or later, where fixes are implemented in commits like bcfd608b264fab654bf78e199bdfbb03e9323eb7 and e3273974506865a24fbb5b65b534d8d4b8dfbf72. Security advisories from Snyk (SNYK-PHP-SPATIEBROWSERSHOT-8496747) detail the vulnerability and proof-of-concept examples available in related GitHub gists.
Details
- CWE(s)