What’s Vulnerable › Vulnerabilities

CVE-2024-21544

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-13 · updated 2026-06-17
• Weakness: CWE-20

Description

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, resulting in Local File Inclusion, which allows the attacker to read sensitive files on the server.

Affected products

• spatie/browsershot: before 5.0.1 — fixed in 5.0.1

How to fix

Upgrade to a fixed version: spatie/browsershot 5.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/spatie/browsershot/blob/1e212b596c104138550ed4ef1b9977d8df570c67/src/Browsershot.php%23L258-L269
• https://github.com/spatie/browsershot/commit/fae8396641b961f62bd756920b14f01a4391296e
• https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745

Get alerted when CVE-2024-21544 or the next vulnerability affects your stack