PT-2025-14839 · Unknown · Spatie/Browsershot

Published 2025-04-04 · Updated 2025-04-09 · CVE-2025-3192

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions spatie/browsershot versions 0.0.0 through 3.1

Description The issue is related to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input. This enables attackers to access localhost and list all of its directories. Attackers can exploit this to access localhost files.

Recommendations For versions 0.0.0 through 3.1, update to a secure version as soon as possible to mitigate the risk of Server-side Request Forgery (SSRF). As a temporary workaround, consider restricting the use of the setUrl() function until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-3192

GHSA-QW64-6VCC-8GHX

Affected Products

Spatie/Browsershot

References · 11

• 🔥 https://gist.github.com/JunMing27/651998a34d57fbf71ff9d25386f1da0f · Exploit
• https://osv.dev/vulnerability/GHSA-qw64-6vcc-8ghx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3192 · Security Note
• https://github.com/spatie/browsershot · Note
• https://twitter.com/cracbot/status/1909924350683120046 · Twitter Post
• https://twitter.com/CveFindCom/status/1908029849303724419 · Twitter Post
• https://twitter.com/CVEnew/status/1908072015262581186 · Twitter Post
• https://twitter.com/cybercronai/status/1908244665926611342 · Twitter Post
• https://t.me/cvedetector/22078 · Telegram Post
• https://twitter.com/SecurtyRating/status/1908032112101331129 · Twitter Post
• https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8548015 · Note