CVE-2026-126779: Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spatie Browsershotto a version that resolves this vulnerability.Fixed in 5.5.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Spatie Browsershot versions from 2.2.0 before 5.5.0 are exposed when untrusted users can influence HTML supplied to setHtml() and can obtain the resulting PDF or screenshot.
What does an attacker need to exploit it?
An attacker needs to supply HTML to setHtml() containing a root-relative resource reference. iframe, img, link, and script elements can reference paths such as /etc/passwd, which are resolved as file:// URLs during rendering.
What information can be exposed?
The vulnerability can expose files readable by the server-side rendering process. Their contents can be incorporated into the generated PDF or screenshot returned by the application.
How can exposure be reduced before upgrading?
Do not allow untrusted input to control HTML passed to setHtml(), or strictly sanitize and reject root-relative resource URLs in iframe, img, link, and script elements.