Improper Input Validation in Spatie Browsershot Allows Local File Access

CVE-2024-21549

What is CVE-2024-21549?

CVE-2024-21549 identifies a significant security flaw in Spatie Browsershot, specifically in versions prior to 5.0.3. The vulnerability stems from improper input validation in the setUrl method, which allows attackers to exploit the application by using the view-source:file:// URI scheme. This exploitation enables unauthorized access to local files, leading to potential data exfiltration or manipulation. This vulnerability is particularly concerning as it bypasses the previous mitigations implemented for CVE-2024-21544. Users of Spatie Browsershot are urged to update their installations to version 5.0.3 or newer to protect against this risk.

References