CVE-2025-1026: Local File Inclusion Vulnerability in Spatie Browsershot
Summary
CVE-2025-1026: Browsershot Local File Inclusion. Affects spatie/browsershot versions < 5.0.5. Fixed in 5.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spatie Browsershot is a popular PHP package that allows developers to easily create screenshots and PDFs from web pages using headless Chrome. It provides a simple API for setting URLs and customizing the rendering process. However, prior to version 5.0.5, the package was found to have a vulnerability related to improper URL validation, which could lead to serious security issues.
Vulnerability Detail
The vulnerability arises from improper input validation in the setUrl method of the Spatie Browsershot package. This flaw allows an attacker to exploit the package by providing a malicious URL that can lead to Local File Inclusion (LFI). As a result, sensitive files on the server may be read by the attacker, potentially exposing confidential information. This vulnerability is a bypass of the previous fix for CVE-2024-21549, indicating that the issue was not adequately addressed in earlier versions.
How To Fix
Minimum fixed version
5.0.5
This is the first release that contains the fix.
composer require spatie/browsershot:5.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to implement additional input validation on the URLs being passed to the setUrl method. Ensure that only valid and expected URLs are processed, and reject any suspicious or malformed inputs.
Conclusion
The CVE-2025-1026 vulnerability in Spatie Browsershot highlights the importance of proper input validation in web applications. By updating to version 5.0.5 or later, developers can mitigate the risks associated with Local File Inclusion and protect sensitive data from unauthorized access.
See every vulnerability recorded for spatie/browsershot →
FAQ
Local File Inclusion (LFI) is a type of security vulnerability that allows an attacker to include files on a server through the web browser. This can lead to unauthorized access to sensitive files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences can include unauthorized access to sensitive files, data breaches, and potential exploitation of the server, leading to further attacks.
The CVSS score of this vulnerability is 8.6, indicating a high level of severity.
While the primary risk is unauthorized access to files, it could potentially lead to data loss if sensitive information is exposed or manipulated by an attacker.
References
Related vulnerabilities
Recent vulnerabilities recorded for spatie/browsershot.
