Local File Read Vulnerability in Spatie Browsershot by Spatie

CVE-2026-126779

What is CVE-2026-126779?

The Spatie Browsershot library prior to version 5.5.0 contains a local file read vulnerability that can be exploited by attackers to gain unauthorized access to server files. By manipulating the HTML input provided to the setHtml() function, attackers can insert embedded elements such as iframe, img, link, or script, pointing to sensitive server file paths. This allows them to render file contents, like system files, into the generated PDF or screenshot output, potentially exposing critical information.

References