High severity8.2GHSA Advisory· Published Apr 4, 2025· Updated Apr 29, 2026

CVE-2025-3192

Description

Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
spatie/browsershotPackagist	<= 5.0.3	—

Affected products

Spatie/BrowsershotGHSA
Range: <= 5.0.3
ghsa-coords
pkg:composer/spatie/browsershot
Range: <= 5.0.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-qw64-6vcc-8ghxghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-3192ghsaADVISORY
gist.github.com/JunMing27/651998a34d57fbf71ff9d25386f1da0fnvdWEB
security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8548015nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000