Vulnerabilities

TI-2026-84894 CVE-2026-121589 · GHSA-p33r-pgmg-6pq6

Incorrect type conversion in spatie url-signer URL validation

LOW 31

A weakness has been identified in spatie url-signer up to 2.1.3.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00419 Published 2026-11-03 Fixed in 2.1.4 CWE-704

TI-2026-63016 CVE-2026-93534 · GHSA-m88j-9w7j-676j

spatie Scotty Self Update SelfUpdater.php update code download

MEDIUM 63

A vulnerability was identified in spatie Scotty up to 1.4.2.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00213 Published 2026-09-18 Fixed in 1.4.3 CWE-494

TI-2026-63015 CVE-2026-93533 · GHSA-q246-734p-8872

spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

MEDIUM 57

A vulnerability was determined in spatie Scotty up to 1.4.4.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.01443 Published 2026-09-18 No fix listed CWE-77

TI-2026-35915 CVE-2026-48557 · GHSA-3ggm-c5m7-hfv5

Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php

MEDIUM 40

Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer().

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0044 Published 2026-05-29 Fixed in 11.23.0 CWE-184

TI-2026-35914 CVE-2026-48555 · GHSA-fggg-964j-3j7h

Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()

LOW 24

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controll…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00248 Published 2026-05-29 Fixed in 11.23.0 CWE-918

TI-2022-21618 CVE-2022-43984 · GHSA-6q49-35h6-rq2p

Browsershot 3.57.3 - Server Side XSS to LFR via HTML

HIGH 69

Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00676 Published 2022-11-25 Fixed in 3.57.4 CWE-79

TI-2022-21617 CVE-2022-43983 · GHSA-82h9-v8vh-mfpq

Browsershot 3.57.2 - Server Side XSS to LFR via HTML

HIGH 69

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00704 Published 2022-11-25 Fixed in 3.57.3 CWE-79

TI-2022-20098 CVE-2022-41706 · GHSA-8c2c-jxwj-jqgf

Browsershot 3.57.2 - Server Side XSS to LFR via URL

HIGH 69

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00662 Published 2022-11-25 Fixed in 3.57.3 CWE-79

TI-2021-20389 CVE-2021-45040 · GHSA-qc53-8q7w-83c4

The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel…

MEDIUM 48

The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03155 Published 2022-03-17 No fix listed CWE-434

TI-2020-06306 CVE-2020-7790 · GHSA-rv74-mh27-4jpv

Arbitrary file read in spatie/browsershot

LOW 26

This affects the package spatie/browsershot from 0.0.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01034 Published 2020-12-11 Fixed in 3.40.1 CWE-22

Vulnerabilities

Filters