Security readout for executives and security teams
Plain-English summary
Browsershot versions before 5.0.5 may let a remote, unauthenticated attacker read sensitive local files when attacker-controlled input reaches setUrl. The issue can expose application secrets or configuration data without modifying systems. It bypasses an earlier correction for CVE-2024-21549.
Executive priority
Prioritize internet-facing applications where users influence rendering URLs. Upgrade promptly and investigate possible secret exposure where such data flow exists. Lower urgency is reasonable only after confirming no vulnerable version or reachable untrusted-input path.
Technical view
Improper URL validation in spatie/browsershot setUrl permits local file inclusion. The supplied CVSS 3.1 score is 8.6: network-accessible, low complexity, no privileges or user interaction, with high confidentiality impact across a security boundary. Integrity and availability impacts are not claimed.
Likely exposure
Exposure requires spatie/browsershot below 5.0.5 and an application path allowing untrusted input to influence setUrl. Internet-facing screenshot, PDF, or browser-rendering features warrant prompt review. Installation alone does not prove exploitability; application data flow determines practical exposure.
Exploitation context
The CVSS vector reports proof-of-concept maturity, and public technical references are listed. However, this CVE is not marked as KEV, and the bundle provides no evidence of active exploitation in the wild. Treat exploit availability as plausible but active abuse as unconfirmed.
Researcher notes
This is identified as a bypass of the CVE-2024-21549 fix, so validation should cover both the original weakness and bypass conditions. The bundle identifies CWE-20 and confidentiality-only impact. It does not establish affected framework configurations, observed attacks, or compromise indicators.
Mitigation direction
- Upgrade spatie/browsershot to version 5.0.5 or later.
- Prevent untrusted input from controlling values passed to setUrl until upgrading.
- Review vendor guidance and the linked corrective commit for deployment considerations.
- Rotate exposed secrets if investigation indicates sensitive local files may have been accessed.
Validation and detection
- Identify installed versions through dependency manifests and lockfiles.
- Trace whether external input can reach Browsershot setUrl.
- Confirm production resolves spatie/browsershot to version 5.0.5 or later.
- Review relevant application and access logs for unexpected local-resource requests.
- Retest affected rendering workflows after upgrading, including prior CVE-2024-21549 regression coverage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-1026 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P3.94snykCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P——snykVulnerability scoring details
Base CVSS 4.0 score
7.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533024CVE reference, snyk
- https://gist.github.com/chuajianshen/6291920112fcf1543fa7b43862112be6CVE reference, snyk
- https://github.com/spatie/browsershot/pull/908CVE reference, snyk
- https://gist.github.com/mrdgef/54a8783408220c67c1b859df38a52d65CVE reference, snyk
- https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72CVE reference, snyk
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.