CVE-2025-1022: Path Traversal Vulnerability in spatie/browsershot
Summary
CVE-2025-1022: Browsershot Path Traversal. Affects spatie/browsershot versions < 5.0.5. Fixed in 5.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spatie/browsershot package is a popular tool for generating screenshots and PDFs from HTML content using headless Chrome. It allows developers to easily convert web pages into images or documents, making it a valuable asset for applications that require visual representations of web content. However, prior to version 5.0.5, the package was susceptible to a path traversal vulnerability that could lead to unauthorized access to sensitive files on the server.
Vulnerability Detail
Versions of the spatie/browsershot package before 5.0.5 are vulnerable to improper input validation in the setHtml function, which is invoked by Browsershot::html(). This vulnerability can be exploited by bypassing the validation checks through the omission of slashes in the file URI, allowing attackers to access sensitive files such as /etc/passwd. The lack of proper validation for user input that should block file URI schemes (e.g., file:// and file:/) in the HTML content is the root cause of this vulnerability. The potential ramifications include unauthorized access to sensitive information and possible system compromise.
How To Fix
Minimum fixed version
5.0.5
This is the first release that contains the fix.
composer require spatie/browsershot:5.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation in your application to sanitize and validate any HTML content passed to the Browsershot::html() function. Ensure that file URIs are blocked and that user input is properly escaped to prevent path traversal attacks.
Conclusion
The spatie/browsershot package has a critical vulnerability (CVE-2025-1022) that can lead to path traversal attacks, allowing unauthorized access to sensitive files. It is crucial for developers using this package to update to version 5.0.5 or later to mitigate the risk. Implementing proper input validation can also help protect against potential exploits.
See every vulnerability recorded for spatie/browsershot →
FAQ
The CVE-2025-1022 vulnerability has a CVSS score of 8.2, indicating a high severity level.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, potentially compromising the security of the system.
Yes, you can implement input validation and sanitization in your application to block file URIs and ensure that user input is properly handled.
If you experience issues after updating, review the package documentation for any breaking changes and ensure that your application code is compatible with the new version.
References
Related vulnerabilities
Recent vulnerabilities recorded for spatie/browsershot.
