CVE-2026-126779 · Package
NO FIX YET · SEE WHAT TO DO
Spatie Browsershot, a PHP library that renders HTML to PDF or screenshots, resolves root-relative references such as /etc/passwd in HTML passed to setHtml() to file:// URLs. An attacker who controls that HTML can read server files and see their contents in the generated PDF or screenshot.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use spatie/browsershot from 2.2.0 up to but not including 5.5.0 and pass HTML into setHtml() that can contain attacker-chosen content, such as user-submitted templates or report content. Sites that only render fixed, trusted HTML or only load URLs are less exposed; the sources do not say more.
Not affected if static-html-only, version-5.5.0-or-later
Who cares browsershot, laravel, pdf-generation, php
composer show spatie/browsershotsetHtml() that include user-supplied HTML5.5.0 or later (fixed version per the advisory; the sources state before 5.5.0 is affected)Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.