---
id: CVE-2025-1022
title: >-
  Versions of the package spatie/browsershot before 5.0.5 are vulnerable to
  Improper Input Validation in the setHtml function, invoked by
  Browsershot::html(), which can be bypassed by omitting the slashes in the file
  URI (e.g., file:../../…
summary: >-
  Versions of the package spatie/browsershot before 5.0.5 are vulnerable to
  Improper Input Validation in the setHtml function, invoked by
  Browsershot::html(), which can be bypassed by omitting the slashes in the file
  URI (e.g., file:../../…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-20
published: '2025-02-05'
updated: '2026-07-15'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-1022'
references:
  - url: 'https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341'
    label: report@snyk.io
  - url: >-
      https://github.com/spatie/browsershot/commit/bcfd608b264fab654bf78e199bdfbb03e9323eb7
    label: report@snyk.io
  - url: >-
      https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496747'
    label: report@snyk.io
  - url: 'https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00463
epssPercentile: 0.39385
ingestedAt: '2026-07-15T16:44:18.994Z'
---

## Overview

Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.

**Note:** Further analysis has identified additional proof-of-concept exploits leveraging the vulnerable function. Developers using this package should ensure proper input validation to mitigate potential risks, as the issue remains unaddressed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.