CVE-2024-21547

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\\. An attacker could read any file on the server by exploiting the normalization of \ into /.

Published 2024-12-18. Last modified 2026-06-17.