Security Advisory

CVE-2024-21544

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2024-12-13 05:00:14

Last updated 2025-10-01 10:28:03

Assigner snyk

CVSS score 8.6

State PUBLISHED

Description

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, resulting in Local File Inclusion, which allows the attacker to read sensitive files on the server.

← Browse all CVEs View on cve.org ↗