Threats tagged 'ghsa-wp7g-f22j-79fp'

Spatie Browsershot versions from 2.2.0 up to but not including 5.5.0 contain a local file read vulnerability. This flaw allows attackers to read arbitrary server files by supplying root-relative paths in HTML content passed to the setHtml() method. By embedding elements such as iframe, img, link, or script referencing file paths like /etc/passwd, attackers can cause the contents of these files to be included in generated PDFs or screenshots.