Security Advisory

CVE-2024-21547

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2024-12-18 06:06:04

Last updated 2024-12-18 14:44:23

Assigner snyk

CVSS score 8.7

State PUBLISHED

Description

Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\\. An attacker could read any file on the server by exploiting the normalization of \ into /.

← Browse all CVEs View on cve.org ↗