~ / search / GHSA-v528-6rq9-h6gw

GHSA-v528-6rq9-h6gw

Spatie Browsershot Directory Traversal vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-21547

Packages

EcosystemPackageAffectedFixed in
Packagist spatie/browsershot < 5.0.2 5.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\\. An attacker could read any file on the server by exploiting the normalization of \ into /.

References

External links from the advisory. They lead to third-party sites.