CVE-2020-7790: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

May 24, 2022 (updated February 1, 2024)

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.

References

github.com/advisories/GHSA-rv74-mh27-4jpv
github.com/spatie/browsershot/commit/8d4bcfb1ff609921007f3fc11d80fcdad35598ac
github.com/spatie/browsershot/issues/441%23issue-735049731
github.com/spatie/browsershot/pull/440
nvd.nist.gov/vuln/detail/CVE-2020-7790
snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-1037064

Code Behaviors & Features

Detect and mitigate CVE-2020-7790 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →