What’s Vulnerable › Vulnerabilities

CVE-2022-41706: Browsershot 3.57.2 - Server Side XSS to LFR via URL

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-11-25 · updated 2026-06-17
• Weakness: CWE-79

Description

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.

Affected products

• spatie/browsershot: 3.57.2

References

• https://fluidattacks.com/advisories/eminem/
• https://github.com/spatie/browsershot/
• https://fluidattacks.com/advisories/eminem/
• https://github.com/spatie/browsershot/

Get alerted when CVE-2022-41706 or the next vulnerability affects your stack