Read the docs
TI-2020-06306 Aliases CVE-2020-7790GHSA-rv74-mh27-4jpv

Arbitrary file read in spatie/browsershot

Priority LOW 26CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.

Why it matters now

EPSS 0.01034 64th percentileScored 2026-11-07
Fix Fixed spatie/browsershot (Packagist): 3.40.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—spatie/browsershot0.0.0 and later—No fix listedCNA
—spatie/browsershot (Packagist)before 3.40.13.40.1Patch availableGHSA-rv74-mh27-4jpv
  • spatie/browsershot Vendor— Affected 0.0.0 and later Fixed in — No fix listed CNA
  • spatie/browsershot (Packagist) Vendor— Affected before 3.40.1 Fixed in 3.40.1 Patch available GHSA-rv74-mh27-4jpv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:spatie:browsershot:*:*:*:*:*:*:*:*all versionsVulnerablespatie
  • cpe:2.3:a:spatie:browsershot:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·spatie

Remediation

  • Fix · GHSA-rv74-mh27-4jpv spatie/browsershot (Packagist) Fixed in 3.40.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7790
  2. 2026-10-03 Alias added: GHSA-rv74-mh27-4jpv

References

Advisory 1

Other 3

  • TI-2022-21618 Browsershot 3.57.3 - Server Side XSS to LFR via HTML CVSS 3.1HIGH 8.2
  • TI-2022-21617 Browsershot 3.57.2 - Server Side XSS to LFR via HTML CVSS 3.1HIGH 8.2
  • TI-2022-20098 Browsershot 3.57.2 - Server Side XSS to LFR via URL CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences