The spatie/browsershot package before version 5.0.5 suffers from improper input validation in its setUrl method. This vulnerability allows an attacker to exploit local file inclusion by bypassing URL validation, potentially exposing sensitive files on the affected system. It is a bypass of the earlier fix for CVE-2024-21549, indicating that the previous mitigation was insufficient. The CVSS 4.0 vector indicates the attack is network exploitable without privileges or user interaction, with high scope impact.

An attacker can leverage this vulnerability to read sensitive local files on a system running vulnerable versions of spatie/browsershot. This could lead to unauthorized disclosure of sensitive information. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates and avoid using vulnerable versions prior to 5.0.5 if possible.