Vulnerability in Browsershot Before 5.0.1 Allows Local File Inclusion

CVE-2024-21544

What is CVE-2024-21544?

The Spatie Browsershot library prior to version 5.0.1 is affected by a vulnerability related to improper input validation in the setUrl method. This flaw allows an attacker to exploit the URL handling by appending leading whitespace characters (%20) before the file:// protocol. As a result, this can lead to Local File Inclusion, enabling the attacker to access and read sensitive files stored on the server. Proper validation and sanitization of input data are crucial to mitigate such risks and protect against unauthorized data exposure.

References