Spatie Browsershot: Local file read via setHtml() in HTML rendering
Summary
Spatie Browsershot versions 2.2.0 up to 5.5.0 (excluding 5.5.0) allow local file reads when HTML passed to setHtml() contains root-relative references such as /etc/passwd in iframe, img, link or script elements. These resolve to file:// URLs and the contents are rendered into the returned PDF or screenshot. An attacker who can influence the HTML can read files that the rendering process can access, for example configuration files or secrets. The vulnerability requires that attacker-influenced HTML reaches the library.
Affected
- spatie/browsershot from 2.2.0 up to but not including 5.5.0
- Versions before 2.2.0: Unknown.
Fixed in
- Fixed in 5.5.0. Local file requests from html() and setHtml() are blocked by default.
Workaround
- Unknown. No vendor-documented workaround for older versions was found.
- Do not pass untrusted HTML to html() or setHtml().
- Run the rendering process as a low-privilege user without access to secrets.
Exploitation
- Exploitation in the wild: Not confirmed.
- Public proof of concept: None found.
- Earlier Browsershot file-read issues were bypasses of previous fixes; no bypass of 5.5.0 is reported yet.
Our recommendation
- Find all projects using spatie/browsershot (check composer.lock) and note the version.
- Upgrade to 5.5.0 or later.
- Retest PDF and screenshot output, because local images, stylesheets and scripts may now be missing.
- Review all calls to html() and setHtml() for user-influenced input.
- Limit file system access of the rendering process.
- Watch for proof-of-concept reports and NVD analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record source: VulnCheck advisory www.vulncheck.com
- Spatie Browsershot release 5.5.0 github.com
- Fix commit eba71ab (block local file requests) github.com
- Pull request #989 github.com
- Browsershot.php at 2.2.0 github.com
- CVE-2026-126779 mirror (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:25.
Original description (NVD)
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot.
NVD references (5)
- https://github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.php#L242-L248
- https://github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516
- https://github.com/spatie/browsershot/pull/989
- https://github.com/spatie/browsershot/releases/tag/5.5.0
- https://www.vulncheck.com/advisories/spatie-browsershot-2.2.0-before-5.5.0-local-file-read-via-sethtml
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.