CVE-2026-126779
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot.
References
- https://github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.php#L242-L248
- https://github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516
- https://github.com/spatie/browsershot/pull/989
- https://github.com/spatie/browsershot/releases/tag/5.5.0
- https://www.vulncheck.com/advisories/spatie-browsershot-2.2.0-before-5.5.0-local-file-read-via-sethtml