CVE-2025-3192 is a Server-side Request Forgery (SSRF) vulnerability in the spatie/browsershot package, specifically in the setUrl() function. Due to missing restrictions on user input, attackers can manipulate the URL parameter to make the server perform unauthorized requests to localhost, potentially listing all directories accessible to the server. This vulnerability affects version 0.0.0 of spatie/browsershot. The CVSS 4.0 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

An attacker can exploit this SSRF vulnerability to make the server access internal resources on localhost, including enumerating directories. This can lead to unauthorized information disclosure about the server's internal file structure. The vulnerability does not require authentication or user interaction, increasing its risk.

No patch or official fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid using the affected version or implement input validation and network-level restrictions to prevent SSRF exploitation.