Cpe:2.3:a:spatie:browsershot:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aspatiebrowsershot/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 20:05:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSpatie Browsershot: Local file read vulnerability (CVE-2026-126779)https://feed.craftedsignal.io/briefs/2026-11-browsershot-lfr-cve-2026-126779/Wed, 11 Nov 2026 20:05:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-browsershot-lfr-cve-2026-126779/Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml().Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd in HTML passed to setHtml(), which resolve to file:// URLs and render file contents into the returned PDF or screenshot.

Impact

Attackers can read server files.

Recommendation

Upgrade the Spatie Browsershot library to version 5.5.0 or later.

]]>highadvisory