GHSA-qw64-6vcc-8ghxHighCVSS 8.2

Browsershot Server-Side Request Forgery (SSRF) via setURL() Function

Published
April 4, 2025
Last Modified
April 4, 2025

🔗 CVE IDs covered (1)

CVE-2025-3192 →

📋 Description

Versions of the package spatie/browsershot from 0.0.0 to 5.0.3 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.

🎯 Affected products1

  • composer/spatie/browsershot:<= 5.0.3

🔗 References (4)