CVE-2025-1022: Input Validation
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/spatie/browsershotto a version that resolves this vulnerability.Fixed in 5.0.5 - Upgrade
Upgrade
spatie/browsershotto a version that resolves this vulnerability.Fixed in 5.0.5 - Configuration
In the input passed to Browsershot::html()/setHtml, add validation to block file URI schemes such as file:// and file:/ so that file:../../../../etc/passwd-style inputs are rejected.
spatie/browsershot (setHtml / Browsershot::html) Block file URI schemes in HTML input = Disallow file:// and file:/ (also bypass forms like file:../../...)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1022?
CVE-2025-1022 has been classified as a medium severity vulnerability due to improper input validation.
How do I fix CVE-2025-1022?
To fix CVE-2025-1022, upgrade the Spatie Browsershot package to version 5.0.5 or later.
What versions are affected by CVE-2025-1022?
Versions of Spatie Browsershot prior to 5.0.5 are affected by CVE-2025-1022.
What is the impact of CVE-2025-1022?
CVE-2025-1022 can lead to unauthorized access to sensitive files on the server due to improper input validation.
How is CVE-2025-1022 exploited?
CVE-2025-1022 can be exploited by constructing a specific file URI without slashes to bypass input validation.