Spatie Browsershot: Local file read vulnerability (CVE-2026-126779)
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml().
CVE search metadata
CVE search record: CVE-2026-126779. Severity: high. CVSS: 7.5. KEV: no. Product: Browsershot (2.2.0 <= version < 5.5.0). Brief: Spatie Browsershot: Local file read vulnerability (CVE-2026-126779). Brief link: https://feed.craftedsignal.io/briefs/2026-11-browsershot-lfr-cve-2026-126779/
Triage facts
Revision 1- Applicability
- Browsershot (2.2.0 <= version < 5.5.0)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd in HTML passed to setHtml(), which resolve to file:// URLs and render file contents into the returned PDF or screenshot.
Impact
Attackers can read server files.
Recommendation
Upgrade the Spatie Browsershot library to version 5.5.0 or later.