CVE-2025-3192: Spatie Browsershot SSRF Vulnerability in setURL() Function
Summary
CVE-2025-3192: Browsershot Server-Side Request Forgery (SSRF) via setURL() Function. Affects spatie/browsershot versions < 5.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spatie Browsershot is a popular PHP package that allows developers to convert HTML to PDF using headless Chrome. It provides a simple interface for generating screenshots and PDFs from web pages. However, versions from 0.0.0 to 5.0.3 are vulnerable to a Server-Side Request Forgery (SSRF) due to insufficient input validation in the setURL() function, which can lead to unauthorized access to internal resources.
Vulnerability Detail
The vulnerability arises from a lack of restrictions on user input in the setURL() function of the Spatie Browsershot package. This oversight allows attackers to craft requests that can access localhost and enumerate its directories, potentially exposing sensitive information or services running on the server. The severity of this vulnerability is rated high, with a CVSS score of 8.2, indicating significant risk to affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the URLs being passed to the setURL() function to prevent access to localhost or any internal resources. For example, you can restrict the URLs to only allow external domains:
$allowedDomains = ['example.com', 'anotherdomain.com'];
$url = 'http://user-input-url.com';
if (in_array(parse_url($url, PHP_URL_HOST), $allowedDomains)) {
$browsershot->setUrl($url);
} else {
throw new Exception('Invalid URL');
}
Conclusion
The Spatie Browsershot package has a critical SSRF vulnerability in its setURL() function, affecting versions up to 5.0.3. It is crucial for developers using this package to update to version 5.0.4 or later to mitigate the risk. Implementing input validation can serve as a temporary workaround while ensuring that applications remain secure.
See every vulnerability recorded for spatie/browsershot →
FAQ
SSRF is a type of attack where an attacker can send crafted requests from a vulnerable server to internal or external resources, potentially leading to data exposure or service disruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may allow attackers to access sensitive internal resources, leading to data breaches or unauthorized access to services.
Yes, the vulnerability has been patched in version 5.0.4 of the Spatie Browsershot package. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for spatie/browsershot.
