Threats affecting pkg:composer/browsershot

CVE-2026-126779 is a local file read vulnerability in Spatie Browsershot versions 2.2.0 up to but not including 5.5.0. The flaw allows attackers to supply root-relative paths in HTML passed to the setHtml() function, causing the software to read and embed local server files into generated PDFs or screenshots. This occurs because elements such as iframe, img, link, or script referencing paths like /etc/passwd are resolved as file:// URLs, exposing sensitive file contents.

A Server-side Request Forgery (SSRF) vulnerability exists in the spatie/browsershot package in the setUrl() function. This flaw allows attackers to supply crafted input that can access localhost and enumerate its directories. The vulnerability affects version 0.0.0 of the package. It has a high severity score of 8.8 based on CVSS 4.0 metrics.

Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content. **Note:** Further analysis has identified additional proof-of-concept exploits leveraging the vulnerable function. Developers using this package should ensure proper input validation to mitigate potential risks, as the issue remains unaddressed.

Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files. **Note:** This is a bypass of the fix for [CVE-2024-21549](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023).