Input Validation Flaw in Browsershot Affects Spatie Software

CVE-2025-1022

What is CVE-2025-1022?

An improper input validation vulnerability exists in versions of the Browsershot package prior to 5.0.5. This flaw allows attackers to bypass security measures by omitting slashes in file URIs (e.g., file:../../../../etc/passwd) when invoking the setHtml function via Browsershot::html(). The vulnerability arises from insufficient validation of user inputs that should prevent file URI schemes such as file:// and file:/ from being processed in the HTML content, potentially enabling unauthorized access to sensitive files.

References