GitHub Advisoryadvisory · Packagist

GHSA-qw64-6vcc-8ghx Browsershot Server-Side Request Forgery (SSRF) via setURL() Function

HIGH Published 2025-04-04 Modified 2025-04-04 Official page ↗
Aliases
CVE-2025-3192
Ecosystem
Packagist
Packages
spatie/browsershot
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-918
Reviewed
2025-04-04

Affected packages

• Packagist spatie/browsershot: <= 5.0.3 (no fix yet)

Description

Versions of the package spatie/browsershot from 0.0.0 to 5.0.3 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.

Related

Alias · CVE (1)

  • CVE-2025-3192 Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References