CVE-2026-126779— Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()

Quick assessment

Affected

spatie browsershot

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Spatie Browsershot 2.2.0 至 5.5.0 之前的版本存在本地文件读取漏洞。攻击者可以通过向方法传入以根目录开头的路径引用（例如），在 HTML 中嵌入、、或等元素，使其解析为协议 URL，从而将服务器文件内容渲染到生成的 PDF 或截图中，实现对服务器文件的读取。

CVSS 7.5 · High Updated Nov 12, 2026

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing

Affected Version Matrix 2

Vendor	Product	Version Range	Status
spatie	browsershot	`2.2.0< 5.5.0`	affected
		`5.5.0`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()

Source: CVE Program / CVE List V5

Vulnerability Description

Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

文件名或路径的外部可控制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
spatie	browsershot	2.2.0 ~ 5.5.0	-

II. Public POCs for CVE-2026-126779

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126779

请登录查看更多情报信息。

Other References for CVE-2026-126779 (5)

https://github.com/spatie/browsershot/pull/989 patch issue-tracking
https://github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.php#L242-L248 technical-description
https://github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516 patch
https://github.com/spatie/browsershot/releases/tag/5.5.0 release-notes
https://www.vulncheck.com/advisories/spatie-browsershot-2.2.0-before-5.5.0-local-file-read-via-sethtml third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126779

IV. Related Vulnerabilities

Same product: browsershot

Same vendor: spatie

Same weakness: CWE-73