{"id":"CVE-2025-1022","title":"Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../…","summary":"Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-20"],"published":"2025-02-05","updated":"2026-07-15","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-1022","references":[{"url":"https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341","label":"report@snyk.io"},{"url":"https://github.com/spatie/browsershot/commit/bcfd608b264fab654bf78e199bdfbb03e9323eb7","label":"report@snyk.io"},{"url":"https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72","label":"report@snyk.io"},{"url":"https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496747","label":"report@snyk.io"},{"url":"https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00463,"epssPercentile":0.3925,"ingestedAt":"2026-07-15T16:44:18.994Z","slug":"CVE-2025-1022","body":"## Overview\n\nVersions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.\r\r**Note:** Further analysis has identified additional proof-of-concept exploits leveraging the vulnerable function. Developers using this package should ensure proper input validation to mitigate potential risks, as the issue remains unaddressed.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}