PHP package security
Is spatie/browsershot vulnerable?
10 known security advisories for spatie/browsershot. The latest was reported on 2025-04-04 and names no fixed version. The newest release, 5.4.2, is not affected by any of them.
4 high 6 medium
- Known advisories
- 10
- Newest release
- 5.4.2
- Released
- 2026-10-26
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for spatie/browsershot
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2025-04-04 | Browsershot Server-Side Request Forgery (SSRF) via setURL() Function GHSA-qw64-6vcc-8ghx · CVE-2025-3192 · GitHub | high | <=5.0.3 | not stated |
| 2025-02-05 | Browsershot Path Traversal GHSA-j2gw-r24m-j2qw · CVE-2025-1022 · GitHub | high | <5.0.5 | 5.0.5 |
| 2025-02-05 | Browsershot Local File Inclusion GHSA-f2q5-6mx7-q9qq · CVE-2025-1026 · GitHub | medium | <5.0.5 | 5.0.5 |
| 2024-12-20 | Browsershot Improper Input Validation vulnerability GHSA-c9f5-29f6-c35w · CVE-2024-21549 · GitHub | medium | <5.0.3 | 5.0.3 |
| 2024-12-18 | Spatie Browsershot Directory Traversal vulnerability GHSA-v528-6rq9-h6gw · CVE-2024-21547 · GitHub | high | <5.0.2 | 5.0.2 |
| 2024-12-13 | Browsershot Local File Inclusion GHSA-g2r4-phv7-5fgv · CVE-2024-21544 · GitHub | medium | <5.0.1 | 5.0.1 |
| 2022-11-25 | Browsershot vulnerable to Cross-Site Scripting (XSS) GHSA-82h9-v8vh-mfpq · CVE-2022-43983 · GitHub | medium | <3.57.3 | 3.57.3 |
| 2022-11-25 | Browsershot version 3.57.3 vulnerable to improper input validation GHSA-6q49-35h6-rq2p · CVE-2022-43984 · GitHub | medium | <3.57.4 | 3.57.4 |
| 2022-11-25 | Browsershot does not validate URL protocols passed to Browsershot URL method GHSA-8c2c-jxwj-jqgf · CVE-2022-41706 · GitHub | high | <3.57.3 | 3.57.3 |
| 2022-05-24 | browsershot local file inclusion vulnerability GHSA-rv74-mh27-4jpv · CVE-2020-7790 · GitHub | medium | <3.40.1 | 3.40.1 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about spatie/browsershot
Does spatie/browsershot have known vulnerabilities?
Yes. Packagist lists 10 security advisories for spatie/browsershot (4 high, 6 medium severity). The most recent, reported 2025-04-04, is "Browsershot Server-Side Request Forgery (SSRF) via setURL() Function". The newest release, 5.4.2, is outside every affected range.
Which version of spatie/browsershot should I run?
The newest stable release is 5.4.2 (published 2026-10-26). Run composer update spatie/browsershot, then composer audit to confirm nothing else is flagged.
How do I check if my spatie/browsershot version is affected?
Run composer show spatie/browsershot in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.