CVE-2025-1026

Summary

CVE-2025-1026 is a new vulnerability affecting versions of the spatie/browsershot package before 5.0.5. This issue arises due to improper input validation through the setUrl method, which enables an attacker to perform Local File Inclusion, bypassing the URL scheme check. Consequently, sensitive files can be read, posing a significant security risk. Notably, this vulnerability bypasses the previous fix for CVE-2024-21549.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.