VYPR
← All advisories
High severity7.5NVD Advisory· Published Dec 18, 2024· Updated Apr 15, 2026

CVE-2024-21547

CVE-2024-21547

Description

Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\\. An attacker could read any file on the server by exploiting the normalization of \ into /.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
spatie/browsershotPackagist
< 5.0.25.0.2

Patches

2
dfc3635b83dd

improve detection of file urls

https://github.com/spatie/browsershotFreek Van der HertenDec 13, 2024via ghsa
commit
2 files changed · +12 −3
  • src/Browsershot.php+6 −2 modified
    @@ -259,8 +259,12 @@ public function setUrl(string $url): static
     {
         $url = trim($url);
 
-        if (str_starts_with(strtolower($url), 'file://') || str_starts_with(strtolower($url), 'file:/')) {
-            throw FileUrlNotAllowed::make();
+        $unsupportedProtocols = ['file://', 'file:/', 'file:\\', 'file:\\\\'];
+
+        foreach($unsupportedProtocols as $unsupportedProtocol) {
+            if (str_starts_with(strtolower($url), $unsupportedProtocol)) {
+                throw FileUrlNotAllowed::make();
+            }
         }
 
         $this->url = $url;
  • tests/BrowsershotTest.php+6 −1 modified
    @@ -54,7 +54,12 @@
 
 it('will not allow a file url', function () {
     Browsershot::url('file://test');
-})->throws(FileUrlNotAllowed::class);
+})->throws(FileUrlNotAllowed::class)->with([
+    'file://test',
+    'file:/test',
+    'file:\test',
+    'file:\\test',
+]);
 
 it('will not allow a file url that has leading spaces', function () {
     Browsershot::url('    file://test');
8a1e3476a9c0
https://github.com/spatie/browsershotvia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.