Security readout for executives and security teams
Plain-English summary
Browsershot versions before 5.0.3 may let a remote attacker make an application read local files when attacker-controlled input reaches URL processing. This can expose credentials, configuration, or other sensitive data available to the browser process. The issue bypasses an earlier fix for CVE-2024-21544.
Executive priority
Prioritize remediation for public services that generate screenshots, PDFs, or browser output from user-influenced URLs. The primary business risk is unauthorized disclosure of secrets or configuration files. Upgrade promptly, then verify deployed versions and reduce the browser process's filesystem access.
Technical view
CVE-2024-21549 is improper input validation in spatie/browsershot's setUrl method. A view-source wrapper around a local-file URL can bypass URL validation and enable arbitrary local-file reading. The supplied CVSS 3.1 score is 8.6, reflecting network reachability, low complexity, no required privileges, and high confidentiality impact.
Likely exposure
Exposure is most likely where applications run spatie/browsershot before 5.0.3 and allow untrusted or indirectly attacker-controlled values to reach setUrl. Impact depends on the files and permissions available to the browser process. The source bundle does not identify specific exposed deployments.
Exploitation context
The CVSS vector records proof-of-concept maturity, but the supplied sources do not establish active exploitation. This CVE is not listed as KEV in the bundle. Treat internet-facing, unauthenticated URL-processing paths as the highest-priority exposure.
Researcher notes
This is a CWE-20 validation flaw and a bypass of the CVE-2024-21544 fix. Review the referenced corrective commit when assessing custom forks or backports. The bundle supports confidentiality impact and the affected-version boundary, but provides no confirmed victim reports or evidence of active exploitation.
Mitigation direction
- Upgrade spatie/browsershot to version 5.0.3 or later.
- Prevent untrusted input from directly or indirectly controlling setUrl values.
- Restrict the browser process from reading unnecessary files and secrets.
- Review current vendor guidance before applying compensating controls.
Validation and detection
- Inventory Composer lockfiles and deployed artifacts for spatie/browsershot versions earlier than 5.0.3.
- Trace whether user-controlled values can reach setUrl through request parameters or stored content.
- Confirm production resolves version 5.0.3 or later after remediation.
- Defensively verify that local-file URL wrappers are rejected without accessing sensitive files.
- Review application logs for unusual local-file or view-source URL handling attempts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-21549 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P3.94snykCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P——snykVulnerability scoring details
Base CVSS 4.0 score
7.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023CVE reference, snyk
- https://github.com/spatie/browsershot/discussions/906CVE reference, snyk
- https://github.com/spatie/browsershot/commit/f791ce0ae8dd99367dbfa30588ee31e1196e1728CVE reference, snyk
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.