CVE-2024-21544

High severity, CVSS 8.6. EPSS: 0.6% chance of exploitation in the next 30 days.

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, resulting in Local File Inclusion, which allows the attacker to read sensitive files on the server.

Published 2024-12-13. Last modified 2026-06-17.