High severity7.5NVD Advisory· Published Nov 11, 2026
CVE-2026-126779
CVE-2026-126779
Description
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <5.5.0
Patches
Vulnerability mechanics
References
5- github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.phpnvd
- github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516nvd
- github.com/spatie/browsershot/pull/989nvd
- github.com/spatie/browsershot/releases/tag/5.5.0nvd
- www.vulncheck.com/advisories/spatie-browsershot-2.2.0-before-5.5.0-local-file-read-via-sethtmlnvd
News mentions
0No linked articles in our index yet.